Global Options

Every vault command accepts the following options. They can be passed at any position in the command.

Options

Option	Type	Description
`--verbose`	flag	Stream request and response diagnostics, including full headers, to stderr in real time. Also writes structured logs to `~/.vault/logs/vault-YYYY-MM-DD.log`.
`-y, --yes`	flag	Skip confirmation prompts. Use in non-interactive or CI environments.
`--api-version <VERSION>`	string	Override the Vault API version for this command (for example, `v24.2`). Defaults to the version negotiated at login.
`-h, --help`	flag	Print help for the current command level. Short-circuits execution. No auth or network call is made. Always exits `0`.
`-V, --version`	flag	Print the installed CLI version and platform. Same as `vault version`.

Targeting a vault

Commands that contact Vault resolve the target vault in this order:

--dns <DNS>: vault DNS passed directly on the command
--access-token <KEY>: token authenticates against the vault set by vault login
Active vault set by vault login

If none of these resolve, the command exits with code 4.

Headless authentication

Authenticate with vault login first, piping the access token via stdin. All subsequent commands use the stored session.

echo "$VAULT_TOKEN" | vault login --dns myorg.veevavault.com --access-token
vault config pull

Confirmation & `-y/--yes`

Commands that delete or overwrite data prompt for confirmation in interactive mode. Pass -y or --yes to skip prompts:

vault config push --yes

Commands that only read or modify local state run immediately without a confirmation prompt.

Verbose output & local logging

Every CLI invocation writes a structured log to ~/.vault/logs/vault-YYYY-MM-DD.log. The log includes the command, its exit code, and timing. No credentials are written.

Pass --verbose to stream full request and response diagnostics to stderr in real time:

vault config pull --verbose

You can also read the local logs directly from ~/.vault/logs/.