diff --git a/spec/controllers/objects_controller_spec.rb b/spec/controllers/objects_controller_spec.rb
deleted file mode 100644
index 3de7d9485b..0000000000
--- a/spec/controllers/objects_controller_spec.rb
+++ /dev/null
@@ -1,43 +0,0 @@
-# frozen_string_literal: true
-
-require 'rails_helper'
-
-RSpec.describe ObjectsController do
-  before do
-    login
-  end
-
-  let(:item) { Dor::Item.new(pid: 'druid:aa123bb4567') }
-
-  before do
-    allow(Dor).to receive(:find).and_return(item)
-    rights_metadata_xml = Dor::RightsMetadataDS.new
-    allow(rights_metadata_xml).to receive_messages(ng_xml: Nokogiri::XML('<xml/>'))
-    allow(item).to receive_messages(
-      id: 'druid:aa123bb4567',
-      datastreams: { 'rightsMetadata' => rights_metadata_xml },
-      rightsMetadata: rights_metadata_xml,
-      remove_druid_prefix: 'aa123bb4567'
-    )
-    allow(rights_metadata_xml).to receive(:dra_object).and_return(Dor::RightsAuth.parse(Nokogiri::XML('<xml/>'), true))
-  end
-
-  describe '/publish' do
-    it 'calls PublishMetadataService and returns 201' do
-      expect(PublishMetadataService).to receive(:publish).with(item)
-      post :publish, params: { id: item.pid }
-      expect(response.status).to eq(201)
-    end
-
-    context 'with bad metadata' do
-      let(:error_message) { "DublinCoreService#ng_xml produced incorrect xml (no children):\n<xml/>" }
-
-      it 'returns a 500 error' do
-        allow(PublishMetadataService).to receive(:publish).and_raise(DublinCoreService::CrosswalkError, error_message)
-        post :publish, params: { id: item.pid }
-        expect(response.status).to eq(500)
-        expect(response.body).to eq(error_message)
-      end
-    end
-  end
-end
diff --git a/spec/requests/publish_object_spec.rb b/spec/requests/publish_object_spec.rb
new file mode 100644
index 0000000000..71b6b1e245
--- /dev/null
+++ b/spec/requests/publish_object_spec.rb
@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Publish object' do
+  let(:payload) { { sub: 'argo' } }
+  let(:jwt) { JWT.encode(payload, Settings.dor.hmac_secret, 'HS256') }
+  let(:object) { Dor::Item.new(pid: 'druid:1234') }
+
+  before do
+    allow(Dor).to receive(:find).and_return(object)
+  end
+
+  context 'with bad metadata' do
+    let(:error_message) { "DublinCoreService#ng_xml produced incorrect xml (no children):\n<xml/>" }
+
+    before do
+      allow(PublishMetadataService).to receive(:publish).and_raise(DublinCoreService::CrosswalkError, error_message)
+    end
+
+    it 'returns a 409 error with location header' do
+      post '/v1/objects/druid:1234/publish', headers: { 'X-Auth' => "Bearer #{jwt}" }
+      expect(response.status).to eq(500)
+      expect(response.body).to eq(error_message)
+    end
+  end
+
+  context 'when the request is successful' do
+    before do
+      allow(PublishMetadataService).to receive(:publish)
+    end
+
+    it 'calls PublishMetadataService and returns 201' do
+      post '/v1/objects/druid:1234/publish', headers: { 'X-Auth' => "Bearer #{jwt}" }
+
+      expect(PublishMetadataService).to have_received(:publish)
+      expect(response.status).to eq(201)
+    end
+  end
+end