diff --git a/public/api.php b/public/api.php
index 4e64a02..2b0848e 100644
--- a/public/api.php
+++ b/public/api.php
@@ -495,9 +495,14 @@ try {
                 throw new InvalidArgumentException("Poste {$extension} introuvable.");
             }
 
+            $cleanExt = preg_replace('/[^a-zA-Z0-9_\-]/', '', $extension);
+
             try {
                 $ami = AmiClient::fromDatabase($db);
-                $cmdOutput = $ami->runCommand("pjsip send notify reboot endpoint " . escapeshellarg($extension));
+                $cmdOutput = $ami->runCommand("pjsip send notify reboot endpoint {$cleanExt}");
+                if (stripos($cmdOutput, 'Unable to') !== false) {
+                    throw new RuntimeException("Échec Asterisk : " . trim($cmdOutput));
+                }
                 echo json_encode([
                     'success' => true,
                     'message' => "Ordre de redémarrage envoyé au poste {$extension} ({$extRow['name']}).",