Agentforce API Actions — External Services & OpenAPI 2026

Agentforce Course — Module 10: REST API Actions | sfinterviewpro.com

🤖 Free Agentforce Course 2026 — sfinterviewpro.com

🌐 Module 10 of 15

REST API Actions
External Services & OpenAPI

Master REST API integration for agents — call external systems. ServiceNow, Jira, Slack, custom APIs. Named Credentials for secure auth. Real XYZ workflows. Error handling & retry logic. Connect agents to any REST API. Interview ready!

GET

POST

Named

Creds

JSON

Parsing

Zero

Keys Exposed

📍 Course Progress — Module 10 of 15

✅M1

✅M2

✅M3

✅M4

✅M5

✅M6

✅M7

✅M8

✅M9

M10API

M11Data

M12Deploy

M13Scale

M14Test

M15Done

🎯 What You’ll Master in This Module

REST API fundamentals (HTTP methods, endpoints, authentication). Named Credentials (secure API key storage). External Services (Salesforce declarative integration). Real XYZ examples (ServiceNow ticket lookup, Jira issue creation, Slack notifications). Error handling & timeouts. JSON parsing. Interview patterns. By end, agents will connect to ANY external system!

<!— PART 1: REST FUNDAMENTALS —>

🌐

Part 1: REST API Fundamentals

HTTP basics. Endpoints. Authentication. How agents call external APIs.

REST API Action = HTTP call from agent to external system (ServiceNow, Jira, Slack, custom APIs). Agents make requests (GET, POST, etc.) — external system responds with data — agent uses result!

HTTP Methods: GET vs. POST vs. PUT

Understanding REST verbs

Method	Purpose	Real XYZ Example	Returns
GET	Fetch data (read-only)	GET /api/incidents/INC0001234 from ServiceNow	Ticket details (JSON)
POST	Create new data	POST /api/issues to Jira (create new issue)	Issue ID + confirmation
PUT	Update existing data	PUT /api/incidents/INC0001234 (update status)	Updated record
DELETE	Delete data	DELETE /api/tasks/TASK123	Confirmation (usually 204)

💡 Real XYZ Workflow

Agent says “Get my ServiceNow incidents” → Agent makes HTTP GET call to ServiceNow API → ServiceNow returns incident list (JSON) → Agent parses & displays to user!

HTTP Anatomy: URL + Headers + Body

What every API call needs

// Complete HTTP Request structure

GET /api/v2/incidents?caller_id=user@xyzcompany.com HTTP/1.1
Host: xyzcompany.service-now.com
Authorization: Bearer <OAuth_Token_from_Named_Credential>
Content-Type: application/json
Accept: application/json

// No body for GET requests

// ===== Response =====
HTTP/1.1 200 OK
Content-Type: application/json

{
  "result": [
    {
      "number": "INC0001234",
      "state": "In Progress",
      "priority": "2",
      "assigned_to": "Support Team",
      "updated_on": "2026-07-17"
    }
  ]
}        

✅ HTTP Status Codes Matter

2xx = Success (200 OK, 201 Created). 4xx = Client Error (400 Bad Request, 401 Unauthorized, 404 Not Found). 5xx = Server Error (500 Internal Server Error). Agents must handle each!

Authentication: API Keys vs. OAuth

Keeping secrets safe with Named Credentials

Auth Type	How It Works	Security Risk	Salesforce Solution
API Key	Token in request header	Key exposed in code	Named Credential stores & encrypts
OAuth 2.0	Access token + refresh token	Token expiration & refresh	Named Credential manages lifecycle
Basic Auth	Username:Password encoded	Credentials visible if HTTPS fails	Named Credential encrypts at rest

🔒 Named Credentials: The Safe Way

NEVER hardcode API keys in Apex or actions! Setup > Named Credentials > Create. Agents reference it by name — Salesforce encrypts & manages auth securely. You never see the raw key!

Real XYZ Example: ServiceNow API Key in Named Credential

Named Credential Name: ServiceNow_ITSM
Endpoint URL: https://xyzcompany.service-now.com
Auth Type: OAuth 2.0
Client ID: xyz_service_account (encrypted by Salesforce)
Client Secret: [hidden] (encrypted by Salesforce)
Agent calls action → “Lookup ServiceNow incident ABC123” → Uses Named Credential “ServiceNow_ITSM” → Salesforce injects auth → Returns incident data securely!

<!— PART 2: EXTERNAL SERVICES —>

⚙️

Part 2: External Services & OpenAPI

Salesforce’s declarative way to integrate REST APIs into agents.

External Services = Salesforce declarative UI that converts OpenAPI specs into actions. Upload OpenAPI JSON → Salesforce parses endpoints → Creates actions automatically. No code needed!

OpenAPI Spec: The Bridge Between Systems

Machine-readable API definition

{
  "openapi": "3.0.0",
  "info": {
    "title": "ServiceNow Incident API",
    "version": "1.0.0"
  },
  "servers": [
    { "url": "https://xyzcompany.service-now.com" }
  ],
  "paths": {
    "/api/now/v2/incidents": {
      "get": {
        "operationId": "getIncidents",
        "summary": "List all incidents",
        "parameters": [
          {
            "name": "caller_id",
            "in": "query",
            "schema": { "type": "string" }
          }
        ],
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": { "$ref": "#/components/schemas/IncidentList" }
              }
            }
          }
        }
      },
      "post": {
        "operationId": "createIncident",
        "summary": "Create new incident",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": { "$ref": "#/components/schemas/IncidentInput" }
            }
          }
        },
        "responses": {
          "201": { "description": "Created" }
        }
      }
    }
  }
}        

✅ Three Ways to Create External Services Actions

Upload OpenAPI: Setup > External Services > Create > Upload openapi.json → Salesforce auto-generates actions
Reference Swagger URL: Many APIs host OpenAPI at /openapi.json or /swagger.json — paste URL directly
Manual Schema: If OpenAPI unavailable, define endpoints & params manually (rare & tedious)

Creating an External Service in Salesforce

Step-by-step walkthrough

Real XYZ: Setting Up ServiceNow External Service

Step 1: Setup > External Services > New External Service
Step 2: Name = “ServiceNow Incidents”
Step 3: Schema Source = “OpenAPI 3.0 URL”
Step 4: Paste URL: https://xyzcompany.service-now.com/api/openapi/v3/spec
Step 5: Authorize > Select Named Credential “ServiceNow_ITSM”
Step 6: “Save & Create” → Salesforce parses OpenAPI → Creates actions “Get Incidents” & “Create Incident”
Step 7: Use in Agentforce action picker!

💡 What Salesforce Creates for You

For each API endpoint (GET /api/incidents, POST /api/issues, etc.), Salesforce creates an Action with mapped parameters — no Apex required. Agents invoke it by name. “Get ServiceNow Incidents” action = declarative REST call!

<!— PART 3: REAL XYZ EXAMPLES —>

🎯

Part 3: Real XYZ Workflows & Error Handling

Practical patterns. ServiceNow, Jira, Slack. Handling timeouts, retries, parsing failures.

Real XYZ Example #1: ServiceNow Incident Lookup

Agent retrieves open incidents for support team

// Agent Action: “Get My ServiceNow Incidents”
// Type: REST API (External Service)
// Named Credential: ServiceNow_ITSM

REQUEST:
GET /api/now/v2/incidents?caller_id={user_email}&state=1,2,3
Authorization: [from Named Credential]
Accept: application/json

AGENT FLOW:
1. User says “Show me open incidents”
2. Agent invokes “Get My ServiceNow Incidents” action
3. Passes {user_email} = current user email
4. ServiceNow API returns:
{
  "result": [
    {
      "number": "INC0001234",
      "short_description": "Website down",
      "priority": "1",
      "state": "In Progress",
      "assigned_to": "Support Lead"
    },
    {
      "number": "INC0001235",
      "short_description": "Email sync error",
      "priority": "2",
      "state": "On Hold",
      "assigned_to": "Network Team"
    }
  ]
}
5. Agent parses JSON & displays:
   “You have 2 open incidents:
   ✅ INC0001234 - Website down (P1, In Progress)
   ✅ INC0001235 - Email sync error (P2, On Hold)”
6. User can ask “Update INC0001234 status to Resolved” 
   → Agent invokes PUT action → ServiceNow updated!        

Real XYZ Example #2: Jira Issue Creation

Agent creates bug tickets from sales conversations

// Agent Action: “Create Jira Bug”
// Type: REST API (External Service)
// Named Credential: Jira_CloudAPI

REQUEST (POST):
POST /rest/api/3/issues
Authorization: Bearer {oauth_token}
Content-Type: application/json

{
  "fields": {
    "project": {
      "key": "XYZPROD"
    },
    "summary": "Customer report: Page load timeout",
    "description": "User reports website takes 30+ seconds to load",
    "issuetype": {
      "name": "Bug"
    },
    "priority": {
      "name": "High"
    },
    "assignee": {
      "name": "dev-team@xyzcompany.com"
    }
  }
}

RESPONSE (201 Created):
{
  "id": "1001234",
  "key": "XYZPROD-9847",
  "self": "https://xyzcompany.atlassian.net/rest/api/3/issue/1001234"
}

AGENT WORKFLOW:
User says “Create a Jira bug for this issue”
→ Agent invokes “Create Jira Bug” action
→ Passes {summary, description, priority}
→ Jira API creates issue XYZPROD-9847
→ Agent tells user: “✅ Created issue XYZPROD-9847. Link: https://jira.xyzcompany.com/XYZPROD-9847”        

Error Handling: Timeouts, 401s, JSON Parsing

What can go wrong & how to handle it

Error Type	Cause	How to Handle	Real XYZ Scenario
401 Unauthorized	Bad token/expired OAuth	Refresh named cred or re-authenticate	Named Cred OAuth expired → Salesforce auto-refreshes
403 Forbidden	User lacks API permissions	Check API role/scopes in Named Cred	Service account missing “incident.read” scope
404 Not Found	Resource doesn’t exist	Validate ID before calling API	ServiceNow incident INC999 doesn’t exist → Return friendly error
500 Server Error	External API crashed	Retry with exponential backoff	Jira down → Wait 2s, retry → If still down, tell user
Timeout (>30s)	Slow API or network	Set timeout, retry, fallback message	ServiceNow query slow → Timeout → Suggest “refine search”
JSON Parse Error	Response not valid JSON	Catch & log, return error to user	API returns HTML error page → Can’t parse JSON → Alert user

💡 Retry Strategy: Exponential Backoff

Try immediately → fail → wait 2s, retry → fail → wait 4s, retry → fail → wait 8s, retry → fail → give up. This avoids hammering overloaded APIs & often succeeds on transient failures!

✅ Best Practices: API Reliability

Always use Named Credentials: NEVER hardcode keys
Handle errors gracefully: User-friendly messages, not stacktraces
Log API calls: Track which calls succeeded, which failed & why
Timeout after 30s: Prevent agent from hanging
Validate inputs: Check IDs, emails, dates before calling API
Rate limiting: Know API rate limits; spread calls over time
Test with sandbox: Always test External Service action in Sandbox first

<!— INTERVIEW Q&A —>

🎤

Interview Q&A: REST API Actions

Common questions from Salesforce interviews. Exact answers expected.

Interview Question	Expected Answer
What is a REST API action in Agentforce?	HTTP call from agent to external system. GET fetches data, POST creates, PUT updates, DELETE removes. All managed by Named Credentials for secure auth.
What’s the difference between External Services and Apex HTTP calls?	External Services = declarative (OpenAPI upload, no code). Apex HTTP = code-based (more control, more complexity). External Services preferred for standard APIs.
What is a Named Credential & why use it?	Secure vault for API keys & OAuth tokens. Encrypted at rest. Salesforce manages token lifecycle (refresh). Never expose keys in code.
How do you handle a 401 Unauthorized error?	Token expired or invalid. Named Credential OAuth auto-refresh usually fixes it. If not, re-authenticate or verify API scope.
What happens if external API times out (>30s)?	Agent stops waiting & returns error. Should retry with backoff or suggest user refine query.
Can you call REST API directly without External Services?	Yes, via Apex HTTP class. But not declaratively in action builder.
What is OpenAPI spec?	Machine-readable JSON describing REST endpoints, parameters, responses. External Services parses it & auto-generates actions.
How do you test an External Service action?	Canvas View → add action → fill params → run. Conversation Preview Panel shows results. Refine in Sandbox before production!

🎯 One-Liner for Interview

“REST API actions let agents call external systems securely via Named Credentials. External Services declaratively converts OpenAPI into actions. No code needed!”

<!— KEY POINTS —>

📌

Key Points to Remember

Summary of module concepts.

GET = Read, POST = Create, PUT = Update, DELETE = Remove: REST verbs map to CRUD operations
Named Credentials = Safe Auth: Encrypted vault for API keys & OAuth. Always use!
External Services = Zero Code: Upload OpenAPI, Salesforce auto-generates actions
HTTP Status Codes Matter: 2xx success, 4xx client error, 5xx server error
Error Handling is Critical: Validate inputs, retry on transient failures, timeout after 30s
Real XYZ Patterns: ServiceNow incident lookup, Jira issue creation, Slack notifications
Agent Calls Actions Declaratively: No code needed in agent script
Test in Sandbox First: Always verify External Service before production deploy

<!— QUIZ —>

Knowledge Check: REST API Actions (5 Questions)

Q1: When should you use Named Credentials instead of hardcoding API keys?

Always! Named Credentials encrypt keys & manage OAuth token lifecycle. Never hardcode secrets.

Q2: What HTTP method creates a new record in an external API?

POST. GET reads, PUT/PATCH updates, DELETE removes, POST creates new.

Q3: How does External Services reduce development effort?

Upload OpenAPI spec → Salesforce auto-parses & generates actions. Zero Apex code needed for standard REST APIs.

Q4: What should you do if an external API call times out after 30 seconds?

Retry with exponential backoff (2s, 4s, 8s). If still failing, tell user to refine query or try again later.

Q5: What is the main benefit of OpenAPI for Salesforce integration?

Standardized API definition → Salesforce understands endpoints, parameters, responses without manual mapping. Speeds up action creation.

<!— NEXT MODULE —>

🚀 Ready for Module 11?

You’ve mastered REST API integration & External Services. Next: Einstein Data Cloud — unified profiles, segmentation, & real-time data for hyper-personalized agents!

Continue to Module 11 →

By SF Interview Pro

Salesforce Interview Prep Team

Practical Q&A by working Salesforce professionals · LWC, Apex, Data Cloud & AI

About Us ↗

☕

☕ Enjoyed this article?

SF Interview Pro is 100% free and maintained by a Salesforce professional. No ads, no paywalls, and no signup required. If this guide helped you prepare for an interview, earn a certification, or grow your Salesforce career, consider buying me a coffee! ☕💜

🇮🇳 UPI (India)

Pay by QR

GPay · PhonePe · Paytm · BHIM

🌎 International

PayPal QR Code to support sfinterviewpro

Pay via PayPal ↗

Scan or tap to pay

New interview questions every week

Follow for fresh Salesforce Q&A, free courses, and real interview experiences — straight from the trenches.

Agentforce API Actions — External Services & OpenAPI 2026

REST API Actions
External Services & OpenAPI

Part 1: REST API Fundamentals

Part 2: External Services & OpenAPI

Part 3: Real XYZ Workflows & Error Handling

Interview Q&A: REST API Actions

Key Points to Remember

🚀 Ready for Module 11?

New interview questions every week

Courses

Interview Prep

Popular Searches

Site

Agentforce API Actions — External Services & OpenAPI 2026

REST API ActionsExternal Services & OpenAPI

Part 1: REST API Fundamentals

Part 2: External Services & OpenAPI

Part 3: Real XYZ Workflows & Error Handling

Interview Q&A: REST API Actions

Key Points to Remember

🚀 Ready for Module 11?

New interview questions every week

Courses

Interview Prep

Popular Searches

Site

REST API Actions
External Services & OpenAPI