Extend the Reach of Your Salesforce Organization with External Services

Sometimes your users need to work with data and services that are outside your Salesforce org. There’s a variety of ways you can provide seamless access across org boundaries. One of them is through External Services.

Connect your Salesforce org to an external API using zero lines of code. Use declarative tools and OpenAPI specifications to describe the external API functionality, and External Services automatically creates invocable actions within Salesforce. Use External Services for outbound integrations from Salesforce using low code, process-based integrations or to turbo charge your Apex integrations. Call the invocable actions natively from Apex, or create a flow or Einstein bot that interacts with the external API source.

With External Services, you first register OpenAPI 2.0 or OpenAPI 3.0 schemas. The operations imported from your registered schema automatically become invocable in Apex, or as External Services action types within point-and-click automation tools such as Flow Builder, Orchestrator, Einstein bots, or OmniStudio Assets.

External Service is best used when the externally hosted service is a RESTful service and the API specification is available in OpenAPI 2.0 or OpenAPI 3.0 JSON schema format.

Define an External Credential and a Named Credential

First, create an external credential to specify an authentication protocol and permission set or profile to use when authenticating to an external system. Second, in order for External Services to authenticate, create a named credential and specify it as the callout endpoint.

Before creating a named credential, you must create at least one external credential to map the named credential to.

Here are the overall steps for using external credentials. The specific steps vary depending on the authentication protocol you choose: OAuth, AWS Signature v4, or a custom protocol. For more on these authentication protocols, see Authentication Protocols for Named Credentials.

• Give the external credential a name and label, and choose an authentication protocol.
• Create principals that map to permission sets, permission set groups, or profiles.
• Optionally, create a custom header for the external credential.
• Authorize user external credentials. Authorize one time for each permission set or user.
• In a named credential, link to the external credential you created.

Create and Edit a Custom Authentication External Credential

1. From Setup, enter Named Credentials in the Quick Find box.
2. Select Named Credentials.
3. Click External Credentials.
4. To create a new external credential, click New. To edit an existing external credential, click its link in the list of external credentials and then click Edit.

5. Complete the fields

• Label

A user-friendly name for the external credential that’s displayed in the Salesforce user interface, such as in list views.

• Name

A unique identifier that’s used to refer to this external credential from callout definitions and through the API.

The name can contain only underscores and alphanumeric characters. It must be unique, begin with a letter, not include spaces, not end with an underscore, and not contain two consecutive underscores.

• Authentication Protocol

Select Custom.

6. Save the external credential. You’re taken to the Named Credentials screen.

If you choose Custom as your authentication protocol, you must specify a principal, sequence number, and authentication parameters. Each authentication parameter requires a name and value. Authentication parameters can be used in custom headers as a formula, for example, $Credential.EC_dev_name.AuthParam_name. See Custom Headers for Credentials, Create and Edit Custom Headers, and Using Basic Authentication with Named Credentials.

Create Principal

After you’ve created an external credential that uses custom authentication, create principals for it. These principals get mapped to permission sets and profiles.

• On the Named Credentials page, click External Credential.
• Select the external credential you created.
• Scroll to Principals.
• Click New to create a principal for this external credential, or choose Edit from the Actions menu of an existing principal.
• When editing an existing principal, not all the fields listed here are modifiable.

After you click New you will see this screen:

Click Add to Add Authentication Parameters:

In this example I gave it a name: ApiKey and a Value: the ApiKey itself, provided by the External Service. We will use this principal as a value of the Custom Header.

Custom Header

Salesforce generates a standard authorization header for each callout to a named-credential-defined endpoint. If you’re creating a custom header, disable Generate Authorization Header in the associated named credential.

Note the following when creating custom headers.

• Headers are sorted by source and sequence number. Headers from named credentials are placed before headers from external credentials.
• Headers from named credentials overwrite headers from external credentials if the names duplicate.
• Headers are allowed to have duplicate header names if they’re from the same source.

Create Custom Header

1. From Setup, enter Named Credentials in the Quick Find box, then select Named Credentials.
2. Click either Named Credentials or External Credentials.
3. If you’re creating a custom header, click New. If you’re editing an existing custom header, select Edit from the Actions menu dropdown for that header.
4. Fill in the fields for the custom header.

• Name

The name of the custom header for this credential (as provided by your External Service).

• Value

The value of the header, evaluated as a formula. For more on setting custom header values, see Using API Keys with Named Credentials, Using Basic Authentication with Named Credentials, and Named Credential Formula Functions.

If you’re using a formula in a custom header and you’ve chosen Named Principal as your Identity Type, don’t use $User in the formula.

• Sequence Number

A number that determines the order in which headers are sent out in the callout. Headers with lower numbers are sent out first.

5. Click Save to save the custom header.

Create Named Credential

• From Setup, enter Named Credentials in the Quick Find box, then select Named Credentials.
• Click Named Credentials.
• To create a new named credential, click New. To edit an existing named credential, click its link in the list of named credentials and then click Edit.

• Give it a Label and Name
• In the URL field fill the Base URL provided by the External Service.
• Deselect Generate Authorization Header, so you can use the Custom Header you just created.
• Select Allow formulas in HTTP header.
• Click Save.

Set up new External service and Register an API spec by copying and pasting it's JSON-formatted schema

To register an API spec by copying and pasting its JSON-formatted schema into your browser:

• From Setup in Lightning Experience, enter External Services in the Quick Find box, and select External Services.
• Click New External Service.
• On the Select an API Source page, select whether you’re importing an API spec From Mulesoft Anypoint Platform, or From API Specification. Since we're using our own spec in this example, select From API Specification.
• Under External Service Name, enter a unique service name.
• Under Description, enter an optional description. A good, short description can help distinguish one service from another in a long list of services.
• Click under Named Credentials and select a named credential from the list.
• Under Service Schema, select Complete JSON. Provide a complete, valid OpenAPI 2.0 or 3.0, and JSON-compliant schema.
• Paste your JSON-formatted schema into the provided text field.
• Click Save & Next. Your uploaded schema is validated by External Services.

In this case select From API Specification and click Next

• Give it a Name
• Select Complete JSON
• Select the Named Credential you just created
• Enter a description
• Paste the JSON schema provided by your external service

Now you can access the external service or you can create an HTTP callout from the action element in your screen flow.

I decided to create HTTP callout called Get Company Info, using Method GET.

You can find and edit your newly created HTTP callout in External Service (from Setup)

Scroll down, provide a Simple Response, review it and save it:

Here is a video showing the creation of new Stock Record from the New Investment screen flow located in the Utility Items of the Dividend Tracking App.

I first check that this particular stock doesn't exist and then after I created a New Investment for it, accessing the flow from the utility items, the record was automatically created and filled with the information from the External service.

Thank you for reading my first LinkedIn Article! I hope you enjoyed it and maybe learned something new!