Hi,
The web service is open, but I use custom authentication to verify that the ESS Job ID in the response matches the one that I received in the initial request. Once I receive a response, I mark a record in a table to say that the ESS Job ID has been consumed. This ensures the Job ID can only be used once.