diff --git a/Fengling.RiskControl.Web/Endpoints/LotteryEndpoints.cs b/Fengling.RiskControl.Web/Endpoints/LotteryEndpoints.cs
index 9bf683c..93f02f6 100644
--- a/Fengling.RiskControl.Web/Endpoints/LotteryEndpoints.cs
+++ b/Fengling.RiskControl.Web/Endpoints/LotteryEndpoints.cs
@@ -31,7 +31,7 @@ public class ParticipateLotteryEndpoint : Endpoint<ParticipateLotteryRequest, Lo
             MemberId = req.MemberId,
             ActivityType = req.ActivityType,
             StakePoints = req.StakePoints,
-            IpAddress = HttpContext.Connection.RemoteIpAddress?.ToString(),
+            IpAddress = HttpContext.Connection.RemoteIpAddress?.ToString() ?? "unknown",
             DeviceId = HttpContext.Request.Headers["X-Device-ID"].FirstOrDefault()
         }, ct);
 
@@ -41,11 +41,8 @@ public class ParticipateLotteryEndpoint : Endpoint<ParticipateLotteryRequest, Lo
 
 public class ParticipateLotteryRequest
 {
-    [Microsoft.AspNetCore.Mvc.FromBody]
     public long MemberId { get; set; }
-    [Microsoft.AspNetCore.Mvc.FromBody]
     public string ActivityType { get; set; } = string.Empty;
-    [Microsoft.AspNetCore.Mvc.FromBody]
     public int StakePoints { get; set; }
 }
 
diff --git a/Fengling.RiskControl.Web/Endpoints/RiskAlertEndpoints.cs b/Fengling.RiskControl.Web/Endpoints/RiskAlertEndpoints.cs
index 17033ad..65cebbe 100644
--- a/Fengling.RiskControl.Web/Endpoints/RiskAlertEndpoints.cs
+++ b/Fengling.RiskControl.Web/Endpoints/RiskAlertEndpoints.cs
@@ -36,7 +36,7 @@ public class GetPendingAlertsEndpoint : Endpoint<EmptyRequest, IEnumerable<RiskA
     }
 }
 
-public class GetPendingAlertsQuery : IRequest<IEnumerable<RiskAlert>>
+public class GetPendingAlertsQuery : IRequest<IEnumerable<RiskAlertResponse>>
 {
 }
 
@@ -74,16 +74,7 @@ public class ResolveAlertEndpoint : Endpoint<ResolveAlertRequest, RiskAlertRespo
             Notes = req.Notes
         }, ct);
 
-        Response = new RiskAlertResponse
-        {
-            Id = alert.Id,
-            MemberId = alert.MemberId,
-            AlertType = alert.AlertType,
-            Description = alert.Description,
-            Priority = alert.Priority.ToString(),
-            Status = alert.Status.ToString(),
-            CreatedAt = alert.CreatedAt
-        };
+        Response = alert;
     }
 }
 
@@ -91,11 +82,10 @@ public class ResolveAlertRequest
 {
     [Microsoft.AspNetCore.Mvc.FromRoute]
     public long AlertId { get; set; }
-    [Microsoft.AspNetCore.Mvc.FromBody]
     public string Notes { get; set; } = string.Empty;
 }
 
-public record ResolveAlertCommand : IRequest<RiskAlert>
+public record ResolveAlertCommand : IRequest<RiskAlertResponse>
 {
     public long AlertId { get; init; }
     public string Notes { get; init; } = string.Empty;
diff --git a/Fengling.RiskControl.Web/Endpoints/RiskAssessmentEndpoints.cs b/Fengling.RiskControl.Web/Endpoints/RiskAssessmentEndpoints.cs
index 38663c3..cb780b9 100644
--- a/Fengling.RiskControl.Web/Endpoints/RiskAssessmentEndpoints.cs
+++ b/Fengling.RiskControl.Web/Endpoints/RiskAssessmentEndpoints.cs
@@ -41,14 +41,9 @@ public class EvaluateRiskEndpoint : Endpoint<EvaluateRiskRequest, RiskEvaluation
 
 public class EvaluateRiskRequest
 {
-    [Microsoft.AspNetCore.Mvc.FromBody]
     public long MemberId { get; set; }
-    [Microsoft.AspNetCore.Mvc.FromBody]
     public string EntityType { get; set; } = string.Empty;
-    [Microsoft.AspNetCore.Mvc.FromBody]
     public string EntityId { get; set; } = string.Empty;
-    [Microsoft.AspNetCore.Mvc.FromBody]
     public string ActionType { get; set; } = string.Empty;
-    [Microsoft.AspNetCore.Mvc.FromBody]
     public Dictionary<string, object>? Context { get; set; }
 }
diff --git a/Fengling.RiskControl.Web/Endpoints/RiskRuleEndpoints.cs b/Fengling.RiskControl.Web/Endpoints/RiskRuleEndpoints.cs
index dc224d1..9e8afce 100644
--- a/Fengling.RiskControl.Web/Endpoints/RiskRuleEndpoints.cs
+++ b/Fengling.RiskControl.Web/Endpoints/RiskRuleEndpoints.cs
@@ -22,6 +22,15 @@ public class CreateRiskRuleEndpoint : Endpoint<CreateRiskRuleRequest, RiskRuleRe
 
     public override async Task HandleAsync(CreateRiskRuleRequest req, CancellationToken ct)
     {
+        if (!Enum.IsDefined(typeof(RiskRuleType), req.RuleType))
+        {
+            ThrowError($"无效的规则类型: {req.RuleType}");
+        }
+        if (!Enum.IsDefined(typeof(RiskRuleAction), req.Action))
+        {
+            ThrowError($"无效的规则动作: {req.Action}");
+        }
+
         var rule = await _mediator.Send(new CreateRiskRuleCommand
         {
             Name = req.Name,
@@ -47,17 +56,11 @@ public class CreateRiskRuleEndpoint : Endpoint<CreateRiskRuleRequest, RiskRuleRe
 
 public class CreateRiskRuleRequest
 {
-    [Microsoft.AspNetCore.Mvc.FromBody]
     public string Name { get; set; } = string.Empty;
-    [Microsoft.AspNetCore.Mvc.FromBody]
     public string Description { get; set; } = string.Empty;
-    [Microsoft.AspNetCore.Mvc.FromBody]
     public int RuleType { get; set; }
-    [Microsoft.AspNetCore.Mvc.FromBody]
     public int Action { get; set; }
-    [Microsoft.AspNetCore.Mvc.FromBody]
     public string ConfigJson { get; set; } = string.Empty;
-    [Microsoft.AspNetCore.Mvc.FromBody]
     public int Priority { get; set; }
 }