Can a flow look something up in an external system through an API?
Yes, with the "HTTP request" step: any REST endpoint, variables in the URL, headers and body, and JSON fields mapped back into flow variables.
Yes. Add an HTTP request step. It calls any REST endpoint with the method, headers and body you define; flow variables such as the customer's answers or CRM fields can be inserted anywhere in the URL, the headers or the body. Fields from the JSON response are mapped into variables that later steps use in messages, conditions or CRM fields, and the step has separate branches for success and error.
Headers you mark as secret, typically the API key, are stored encrypted and are not shown again after saving; a re-save without retyping keeps the stored value. The request itself is made by an isolated worker, not by the WASync server, and only to public addresses.