Fetch calls from injected HTML to Suitelets can work but may lead to CORS issues and authentication problems. The injected HTML runs in a different context than the server-side script. This makes session management complicated. A better approach is to handle data processing within the User Event script itself. Alternatively, use client scripts with the N/https module for API calls that remain within NetSuite's security context.