<a id="cc-custom-smt-external-egress"></a>

# Enable External Network Calls from Custom SMTs

Custom Single Message Transformations (SMTs) cannot make external network
calls by default. Enable external egress per connector to allow your Custom
SMT to call endpoints outside Confluent Cloud, such as key management services
(KMS), secret stores, or data enrichment APIs.

#### NOTE
External egress for Custom SMTs is a Limited Availability feature in
Confluent Cloud, available at no additional cost during this phase.

If you would like to participate in the Limited Availability Program,
contact [Confluent Support](https://support.confluent.io/) or your
Confluent account team to enable external egress for your organization.

## Prerequisites

Before enabling external egress, verify that you have:

- **Custom SMT artifact**: A Custom SMT artifact uploaded to your environment. For details, see [Configure Custom SMT for Kafka Connectors in Confluent Cloud](quick-start-custom-smt.md#cc-custom-single-message-transforms).
- **Co-located destination service**: The external service must be hosted in the same region as the connector.
- **PrivateLink Endpoint (AWS)**: Required only if your Custom SMT must reach a private endpoint. You need an Egress PrivateLink Endpoint on an Egress PrivateLink gateway in the same region as the connector. See [Use AWS Egress PrivateLink Endpoints for Serverless Products on Confluent Cloud](../../networking/aws-egress-privatelink-esku.md#cloud-networking-privatelink-aws-egress-esku).

## Limitations

For information about limits and constraints, see [Custom SMT external
egress limitations](custom-smt-limitations-support.md#cc-custom-smt-external-egress-limits), including which
destinations are reachable for your cloud provider and cluster type.

## Enable external egress on a connector

To allow Custom SMTs on a connector to make outbound network calls, set `csmt.egress.enable` to `true` in the connector configuration.

| Configuration property   | Type    | Default   | Description                                                                  |
|--------------------------|---------|-----------|------------------------------------------------------------------------------|
| `csmt.egress.enable`     | Boolean | `false`   | Enables outbound network calls for Custom SMTs configured on this connector. |

#### NOTE
You can configure external egress only through the connector
configuration, using the Confluent CLI, the Confluent Cloud REST API, or Terraform.
Confluent Cloud Console doesn’t support this property. For the complete list
of supported interfaces and other constraints, see [Custom SMT
external egress reachability](custom-smt-limitations-support.md#cc-custom-smt-external-egress-limits).

### Create a new connector with egress enabled

1. Set `csmt.egress.enable` to `true` in your connector configuration,
   with your Custom SMT’s own transform properties. The following
   example saves a source connector configuration as `conn-config.json`,
   with an `encryptfield` Custom SMT that calls an external KMS:
   ```json
   {
     "connector.class": "DatagenSource",
     "name": "DatagenSourceCustomSmtEgress",
     "kafka.auth.mode": "SERVICE_ACCOUNT",
     "kafka.service.account.id": "<service_account_id>",
     "kafka.topic": "datagen-source-csmt",
     "output.data.format": "JSON",
     "quickstart": "ORDERS",
     "tasks.max": "1",
     "transforms": "encryptfield",
     "transforms.encryptfield.type": "com.example.kafka.connect.smt.EncryptField$Value",
     "transforms.encryptfield.custom.smt.artifact.id": "<custom_smt_artifact_id>",
     "csmt.egress.enable": "true"
   }
   ```
2. Create the connector using your configuration file (`conn-config.json`):
   ```bash
   confluent connect cluster create --config-file conn-config.json --cluster <kafka_cluster_id>
   ```

### Enable egress on an existing connector

To enable external egress on a running connector, update its configuration
using the Confluent CLI:

```bash
confluent connect cluster update <connector_id> --config csmt.egress.enable=true --cluster <kafka_cluster_id>
```

## Best practices

- **Set request timeouts**: Implement explicit connection and read timeouts within your Custom SMT code. Unresponsive network calls can stall processing and cause connector task failures.
- **Implement error logging**: Add detailed exception logging within the SMT code to simplify network and API troubleshooting.