Based on JSON reference spec, the $ref value is an URI, which by definition is a resource identifier only, and is independent of access.
It seems it is valid to use a well formed URI, but not an accessible URL (assuming http).
However, if it is not a valid URL for external reference, how would different tools resolve the references?