Request / Acknowledge / Callback between ASP.NET Server and non-ASP.NET Clients

I want to implement a Request/Acknowledge/Callback (or Push / Represent) pattern on an ASP.NET API. I'd usually use SignalR for that kind of things, but I want to support clients using non .NET technologies such as PHP.

'Web Hooks' seem inappropriate since I want a single callback and not an event system, and anyways, it's more of a concept than an actual framework.

The first thing that comes to mind is to accept a callback URL as a parameter (either in the query or the body, it's somehow irrelevant) and make an HttpPush once the processing is done, but I'm wondering about 2 things if I go down that road.

1. Is there a better way?
2. Are there any security concerns I should be concerned about if I do that?

(I didn't mention it, but yes, I'd return a 202 with some correlation ID the first time around)