diff --git a/server/src/main/java/com/rocketmq/studio/instance/InstanceController.java b/server/src/main/java/com/rocketmq/studio/instance/InstanceController.java
index a7d11860..df52c23e 100644
--- a/server/src/main/java/com/rocketmq/studio/instance/InstanceController.java
+++ b/server/src/main/java/com/rocketmq/studio/instance/InstanceController.java
@@ -19,6 +19,7 @@
 
 import com.rocketmq.studio.common.domain.Result;
 import com.rocketmq.studio.common.domain.enums.InstanceType;
+import jakarta.validation.Valid;
 import lombok.RequiredArgsConstructor;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -28,7 +29,6 @@
 import org.springframework.web.bind.annotation.RestController;
 
 import java.util.List;
-import java.util.Map;
 
 @RestController
 @RequestMapping("/api/instances")
@@ -55,8 +55,8 @@ public Result<InstanceVO> updateInstance(@RequestBody InstanceVO instance) {
     }
 
     @PostMapping("/delete")
-    public Result<Void> deleteInstance(@RequestBody Map<String, String> body) {
-        instanceService.deleteInstance(body.get("id"));
+    public Result<Void> deleteInstance(@Valid @RequestBody InstanceDeleteRequestDTO request) {
+        instanceService.deleteInstance(request.getId());
         return Result.ok();
     }
 }
diff --git a/server/src/main/java/com/rocketmq/studio/instance/InstanceDeleteRequestDTO.java b/server/src/main/java/com/rocketmq/studio/instance/InstanceDeleteRequestDTO.java
new file mode 100644
index 00000000..095a625d
--- /dev/null
+++ b/server/src/main/java/com/rocketmq/studio/instance/InstanceDeleteRequestDTO.java
@@ -0,0 +1,32 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.rocketmq.studio.instance;
+
+import jakarta.validation.constraints.NotBlank;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class InstanceDeleteRequestDTO {
+    @NotBlank(message = "id is required")
+    private String id;
+}
diff --git a/server/src/test/java/com/rocketmq/studio/instance/InstanceControllerTest.java b/server/src/test/java/com/rocketmq/studio/instance/InstanceControllerTest.java
index e4400b1d..5871d7b7 100644
--- a/server/src/test/java/com/rocketmq/studio/instance/InstanceControllerTest.java
+++ b/server/src/test/java/com/rocketmq/studio/instance/InstanceControllerTest.java
@@ -36,6 +36,7 @@
 import static org.mockito.ArgumentMatchers.isNull;
 import static org.mockito.Mockito.doNothing;
 import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
 import static org.mockito.Mockito.when;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
@@ -175,6 +176,30 @@ void deleteInstanceShouldReturnSuccess() throws Exception {
         verify(instanceService).deleteInstance("inst-1");
     }
 
+    @Test
+    void deleteInstanceShouldRejectBlankId() throws Exception {
+        mockMvc.perform(post("/api/instances/delete")
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .content(objectMapper.writeValueAsString(Map.of("id", " "))))
+                .andExpect(status().isBadRequest())
+                .andExpect(jsonPath("$.code").value(400))
+                .andExpect(jsonPath("$.message").value("id is required"));
+
+        verifyNoInteractions(instanceService);
+    }
+
+    @Test
+    void deleteInstanceShouldRejectMissingId() throws Exception {
+        mockMvc.perform(post("/api/instances/delete")
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .content(objectMapper.writeValueAsString(Map.of())))
+                .andExpect(status().isBadRequest())
+                .andExpect(jsonPath("$.code").value(400))
+                .andExpect(jsonPath("$.message").value("id is required"));
+
+        verifyNoInteractions(instanceService);
+    }
+
     private InstanceVO buildInstance(String id, String name, InstanceType type, String endpoint) {
         InstanceVO instance = InstanceVO.builder()
                 .name(name)