---
title: "Setup"
description: "Create a VICAL Service when you need to publish signed VICAL feeds from stored IACA certificates."
stack: "Enterprise Stack (commercial) — version 0.21.0"
stack_version: "0.21.0"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/enterprise-stack/services/vical-service/setup
generated: 2026-07-20
---
# Setup

Create a VICAL Service when you need to publish signed VICAL feeds from stored IACA certificates.

## Before you start

- Have an existing signing key available, typically in a [Key Management Service](https://docs.walt.id/enterprise-stack/services/key-management-service/overview.md).
- Have an existing signer certificate stored in an [X.509 Store Service](https://docs.walt.id/enterprise-stack/services/x509-store-service/overview.md).
- If the signer certificate is not self-signed, have the signer certificate chain stored as separate certificates as well.
- If you need source entries for publication, add `vical-entry` records to an [X.509 Store Service](https://docs.walt.id/enterprise-stack/services/x509-store-service/manage-certificates.md).

## Create the service

**Option: CURL**

Endpoint: `/v1/{target}/resource-api/services/create` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html#/Service%20%2F%20Resource/post_v1__target__resource_api_services_create)

**Example Request**

```bash
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/resource-api/services/create' \
  -H 'accept: */*' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "type": "vical-service",
  "signingKeyId": "test.tenant1.kms1.vical-signing-key",
  "signerCertificateId": "test.tenant1.x509-store-1.vical-signer",
  "signerCertificateChainIds": [
    "test.tenant1.x509-store-1.vical-root"
  ]
}'
```

**Body**

```json
{
  "type": "vical-service",
  "signingKeyId": "test.tenant1.kms1.vical-signing-key",
  "signerCertificateId": "test.tenant1.x509-store-1.vical-signer",
  "signerCertificateChainIds": [
    "test.tenant1.x509-store-1.vical-root"
  ]
}
```

**Path Parameters**

- `orgID`: - When performing operations within an organization, it is essential to use the organization's Base URL or another valid host alias. For example, if your organization is named `test`, your default Base URL will be `test.enterprise-sandbox.waltid.dev` when using the sandbox environment.
- `target`: _resourceIdentifier_ - The target indicates the organization + tenant in which to create the new VICAL service and the service's ID (`{organizationID}.{tenantID}.[NewVicalServiceID]`), e.g. `test.tenant1.vical-service`.

**Body Parameters**

- `type`: _serviceType_ - Specifies the type of service to create. In this case `vical-service`.
- `signingKeyId`: _resourceIdentifier_ - Fully-qualified path of the signing key used to sign published VICAL artifacts.
- `signerCertificateId`: _resourceIdentifier_ - Fully-qualified path of the stored signer certificate that matches `signingKeyId`.
- `signerCertificateChainIds`: _resourceIdentifier[]_ - Optional list of fully-qualified stored certificate paths representing the signer certificate chain.

**Response Codes**

- `201` - Service created successfully.

**Note:**

The signer certificate must match the configured signing key. If the signer certificate is self-signed, omit `signerCertificateChainIds`. If it is not self-signed, provide a populated certificate chain.

**Note:**

The KMS service that owns `signingKeyId` and the X.509 Store services that own the configured certificate IDs are required dependencies for the VICAL Service.

## Attach an X.509 Store service

Attach one or more X.509 Store services so the VICAL Service has `vical-entry` certificates to publish.

**Option: CURL**

Endpoint: `/v1/{target}/vical-service-api/dependencies/add` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html#/Service%20%7C%20VICAL%20Service%20%7C%20Publication%20Management)

**Example Request**

```bash
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/vical-service-api/dependencies/add' \
  -H 'accept: */*' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d 'test.tenant1.x509-store-1'
```

**Path Parameters**

- `orgID`: - When performing operations within an organization, it is essential to use the organization's Base URL or another valid host alias. For example, if your organization is named `test`, your default Base URL will be `test.enterprise-sandbox.waltid.dev` when using the sandbox environment.
- `target`: _resourceIdentifier_ - The target indicates the organization + tenant + VICAL service to which to add an existing dependency service (`{organizationID}.{tenantID}.{vicalServiceID}`), e.g. `test.tenant1.vical-service`.

**Body Parameters**

- `dependency`: _String_ - JSON string containing the fully-qualified path of the X.509 Store service to link, for example `test.tenant1.x509-store-1`.

**Response Codes**

- `201` - Dependency attached successfully.

**Note:**

Each publication reads all attached X.509 stores and includes only stored entries of type `vical-entry`. If no attached store contains at least one `vical-entry`, publication cannot succeed.

You can inspect or update the signer references later through `/v1/{target}/vical-service-api/configuration/view` and `/v1/{target}/vical-service-api/configuration/update`.