Snowflake External Access Integration: Call External APIs Directly from UDFs

External Access Integration is a Snowflake feature that lets code inside UDFs, stored procedures, and Streamlit apps access external HTTPS endpoints directly. Previously, external communication was only possible through External Functions (via API Gateway), but this feature enables direct communication using Python/Java HTTP libraries (such as requests or urllib).

Overall Architecture of External Access Integration

UDF / Stored Procedure / Streamlit
  │
  ├─ EXTERNAL_ACCESS_INTEGRATIONS = (my_eai)  <- set on the function definition
  │
  └─ External Access Integration (my_eai)
       │
       ├─ ALLOWED_NETWORK_RULES = (rule_1, rule_2)  <- controls the destinations
       │    └─ Network Rule (rule_1)
       │         ├─ TYPE = HOST_PORT
       │         └─ VALUE_LIST = ('api.openai.com:443')
       │
       └─ ALLOWED_AUTHENTICATION_SECRETS = (api_key_secret)  <- credentials
            └─ Secret (api_key_secret)
                 └─ TYPE = GENERIC_STRING / OAUTH2 / PASSWORD

Step 1: Create a Network Rule

-- Network Rule that allows access to an external host
CREATE OR REPLACE NETWORK RULE openai_rule
  MODE = EGRESS
  TYPE = HOST_PORT
  VALUE_LIST = ('api.openai.com:443');

-- Allowing several hosts
CREATE OR REPLACE NETWORK RULE multi_api_rule
  MODE = EGRESS
  TYPE = HOST_PORT
  VALUE_LIST = (
    'api.openai.com:443',
    'api.anthropic.com:443',
    'hooks.slack.com:443'
  );

Set the Network Rule's MODE to EGRESS (outbound direction). Use TYPE HOST_PORT to allow combinations of hostname and port. For HTTPS, specify port 443.

Step 2: Create a Secret

-- Generic String secret (an API key)
CREATE OR REPLACE SECRET openai_api_key
  TYPE = GENERIC_STRING
  SECRET_STRING = 'sk-proj-xxxxxxxxxxxxxxxxxxxx';

-- OAuth2 secret (the token refreshes automatically)
CREATE OR REPLACE SECRET salesforce_oauth
  TYPE = OAUTH2
  API_AUTHENTICATION = salesforce_security_integration
  OAUTH_REFRESH_TOKEN = 'xxxxxxxx';

-- Password secret (Basic authentication)
CREATE OR REPLACE SECRET basic_auth_secret
  TYPE = PASSWORD
  USERNAME = 'api_user'
  PASSWORD = 'secure_password_123';

Step 3: Create the External Access Integration

-- Create the External Access Integration
CREATE OR REPLACE EXTERNAL ACCESS INTEGRATION openai_eai
  ALLOWED_NETWORK_RULES = (openai_rule)
  ALLOWED_AUTHENTICATION_SECRETS = (openai_api_key)
  ENABLED = TRUE;

-- Combining several Network Rules and Secrets
CREATE OR REPLACE EXTERNAL ACCESS INTEGRATION multi_api_eai
  ALLOWED_NETWORK_RULES = (multi_api_rule)
  ALLOWED_AUTHENTICATION_SECRETS = (openai_api_key, slack_webhook_secret)
  ENABLED = TRUE;

Step 4: Use Inside a UDF

-- Call an external API from a Python UDF
CREATE OR REPLACE FUNCTION call_openai_chat(prompt VARCHAR)
RETURNS VARCHAR
LANGUAGE PYTHON
RUNTIME_VERSION = '3.10'
PACKAGES = ('requests')
HANDLER = 'run'
EXTERNAL_ACCESS_INTEGRATIONS = (openai_eai)
SECRETS = ('api_key' = openai_api_key)
AS $$
import requests
import _snowflake

def run(prompt):
    api_key = _snowflake.get_generic_secret_string('api_key')
    response = requests.post(
        'https://api.openai.com/v1/chat/completions',
        headers={
            'Authorization': f'Bearer {api_key}',
            'Content-Type': 'application/json'
        },
        json={
            'model': 'gpt-4o-mini',
            'messages': [{'role': 'user', 'content': prompt}],
            'max_tokens': 500
        },
        timeout=30
    )
    response.raise_for_status()
    return response.json()['choices'][0]['message']['content']
$$;

-- Call the UDF
SELECT call_openai_chat('What is Snowflake? Explain it in 30 words.');

Use Inside a Stored Procedure

-- Slack notification procedure
CREATE OR REPLACE PROCEDURE send_slack_alert(message VARCHAR)
RETURNS VARCHAR
LANGUAGE PYTHON
RUNTIME_VERSION = '3.10'
PACKAGES = ('requests')
HANDLER = 'run'
EXECUTE AS CALLER
EXTERNAL_ACCESS_INTEGRATIONS = (multi_api_eai)
SECRETS = ('webhook_url' = slack_webhook_secret)
AS $$
import requests
import _snowflake

def run(session, message):
    webhook_url = _snowflake.get_generic_secret_string('webhook_url')
    response = requests.post(
        webhook_url,
        json={'text': f':warning: Snowflake Alert: {message}'},
        timeout=10
    )
    response.raise_for_status()
    return f'Sent: {response.status_code}'
$$;

CALL send_slack_alert('The ETL pipeline failed');

Secret Type Comparison

External Function vs External Access Integration

Required Privileges

Best Practices

• Allow only the minimum necessary hosts in Network Rules: List only the FQDNs you actually call in VALUE_LIST to prevent unnecessary external communication.
• Store API keys in Secrets, never hard-code them: Using Secrets means you do not have to modify UDF code when rotating keys.
• Implement timeouts and retries: Always set a timeout parameter on external API calls to handle transient failures.
• Separation of duties: Have security administrators create EAIs/Secrets/Network Rules, and developers create UDFs, keeping roles separated.

Check Your Understanding

Frequently Asked Questions