diff --git a/src/server/app.py b/src/server/app.py
index 179e934..165f446 100644
--- a/src/server/app.py
+++ b/src/server/app.py
@@ -5,7 +5,7 @@ from pathlib import Path
 
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI, HTTPException, Depends, Request
+from fastapi import FastAPI, HTTPException, Depends, Request, Query
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import RedirectResponse
 from pydantic import BaseModel, Field, model_validator
@@ -166,7 +166,9 @@ def delete_document(
     file_name: str,
     state: AppState = Depends(get_state),
     _: bool = Depends(verify_api_key),
-    collection: str | None = None,
+    collection: str | None = Query(
+        default=None, max_length=128, pattern=r"^[a-zA-Z0-9_-]+$",
+    ),
 ):
     if not file_name or len(file_name) > 512:
         raise HTTPException(status_code=400, detail="file_name 长度应在 1-512 之间")