If I have a restlet that I want to call with a user event, do I need to do that with the external url of the restlet and send headers, or can it be done internally?

include the restlet code as a library for your user event and use it from there

to answer the original question, AFAIK you have to use the external url in that case and hence authenticate.