I know that we are cautious about adding the external_id to publicly viewable data, but it seems like it would be safe to add it to the webhook payload. Possibly someone on the Discourse engineering team will have ideas about that.
Looking at the code, it doesn’t seem like it would be difficult to add the external_id for all users to the User Event webhook through a plugin. I’d like to have a better understanding of why we’re only passing the external_id for admin users before suggesting that approach though.