Preventing thir party lookup field from being abused

Hi,

We have a web app that includes a look up with a third party. We have identified that a user could smash this lookup hard resulting in many requests being sent and each one resulting in a fee. Is there something in ASM that can be used in order to prevent this from occurring? It is worth noting the the URLs include a dynamic guid so the URL will never be the same for different users.

Essentially we would want to limit replay attack and also replay attack with modified details, eg attacker changes unique values, adds X-Forwarded-For headers etc, or if they used bots to assault the lookup.

Thank you