How to best integrate an external API?

You can write an update or a generic action that will communicate with an external API using essentially regular Elixir code. You can definitely model the quote items as an embedded resource to store the results of those calls in the attributes etc.

You can do something like:

update :get_quote do
  change fn changeset, _ -> 
    Ash.Changeset.before_transaction(changeset, fn changeset -> 
      # make an external call and save the results in the changeset here.
    end)
  end
end 

or you could use a generic action

# perhaps you return the quote number. You can return whatever type you want here.
action :get_quote, :struct do
  constraints instance_of: Quote
  argument :quote_request_id, :uuid

  run fn input, _context -> 
    # lookup the quote
    # make an external call
    # update the quote
    # return {:ok, quote}
  end
end

AshPhoenix.Form supports managing nested forms/related data, and you can lookup the credentials for the organization/tenant before making your request.