diff --git a/java/com/google/domain/registry/env/common/tools/WEB-INF/web.xml b/java/com/google/domain/registry/env/common/tools/WEB-INF/web.xml
index c170c6aac..839a600c1 100644
--- a/java/com/google/domain/registry/env/common/tools/WEB-INF/web.xml
+++ b/java/com/google/domain/registry/env/common/tools/WEB-INF/web.xml
@@ -8,7 +8,7 @@
   <servlet>
     <display-name>Verify OTE</display-name>
     <servlet-name>verify-ote</servlet-name>
-    <servlet-class>com.google.domain.registry.ui.server.admin.VerifyOteServlet</servlet-class>
+    <servlet-class>com.google.domain.registry.module.tools.ToolsServlet</servlet-class>
     <load-on-startup>1</load-on-startup>
   </servlet>
   <servlet-mapping>
diff --git a/java/com/google/domain/registry/module/tools/ToolsRequestComponent.java b/java/com/google/domain/registry/module/tools/ToolsRequestComponent.java
index 45d32641c..0e395dc10 100644
--- a/java/com/google/domain/registry/module/tools/ToolsRequestComponent.java
+++ b/java/com/google/domain/registry/module/tools/ToolsRequestComponent.java
@@ -36,6 +36,7 @@ import com.google.domain.registry.tools.server.ListReservedListsAction;
 import com.google.domain.registry.tools.server.ListTldsAction;
 import com.google.domain.registry.tools.server.ToolsServerModule;
 import com.google.domain.registry.tools.server.UpdatePremiumListAction;
+import com.google.domain.registry.tools.server.VerifyOteAction;
 import com.google.domain.registry.tools.server.javascrap.AnnihilateNonDefaultNamespacesAction;
 
 import dagger.Subcomponent;
@@ -68,4 +69,5 @@ interface ToolsRequestComponent {
   PublishDetailReportAction publishDetailReportAction();
   ResaveAllEppResourcesAction resaveAllEppResourcesAction();
   UpdatePremiumListAction updatePremiumListAction();
+  VerifyOteAction verifyOteAction();
 }
diff --git a/java/com/google/domain/registry/tools/VerifyOteCommand.java b/java/com/google/domain/registry/tools/VerifyOteCommand.java
index 97effbe50..04493208d 100644
--- a/java/com/google/domain/registry/tools/VerifyOteCommand.java
+++ b/java/com/google/domain/registry/tools/VerifyOteCommand.java
@@ -26,12 +26,14 @@ import com.google.common.collect.ImmutableSet;
 import com.google.domain.registry.config.RegistryEnvironment;
 import com.google.domain.registry.model.registrar.Registrar;
 import com.google.domain.registry.tools.Command.GtechCommand;
+import com.google.domain.registry.tools.server.VerifyOteAction;
 
 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
 
 import java.io.IOException;
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.List;
 import java.util.Map;
 import java.util.Map.Entry;
@@ -81,11 +83,13 @@ final class VerifyOteCommand implements ServerSideCommand, GtechCommand {
       // the input is valid.
       verifyNotNull(loadByClientId(clientId + "-1"), "Registrar %s does not exist.", clientId);
     }
-    Iterable<String> registrars =
+    Collection<String> registrars =
         mainParameters.isEmpty() ? getAllRegistrarNames() : mainParameters;
     Map<String, Object> response = connection.sendJson(
-        "/_dr/admin/verifyOte",
-        ImmutableMap.of("summarize", Boolean.toString(summarize), "registrars", registrars));
+        VerifyOteAction.PATH,
+        ImmutableMap.of(
+            "summarize", Boolean.toString(summarize),
+            "registrars", new ArrayList<>(registrars)));
     System.out.println(Strings.repeat("-", 80));
     for (Entry<String, Object> registrar : response.entrySet()) {
       System.out.printf(
diff --git a/java/com/google/domain/registry/tools/server/BUILD b/java/com/google/domain/registry/tools/server/BUILD
index 6b10df66d..2e2833afe 100644
--- a/java/com/google/domain/registry/tools/server/BUILD
+++ b/java/com/google/domain/registry/tools/server/BUILD
@@ -12,6 +12,7 @@ java_library(
         "//java/com/google/common/io",
         "//java/com/google/domain/registry/config",
         "//java/com/google/domain/registry/export",
+        "//java/com/google/domain/registry/flows",
         "//java/com/google/domain/registry/gcs",
         "//java/com/google/domain/registry/groups",
         "//java/com/google/domain/registry/mapreduce",
diff --git a/java/com/google/domain/registry/ui/server/admin/VerifyOteServlet.java b/java/com/google/domain/registry/tools/server/VerifyOteAction.java
similarity index 94%
rename from java/com/google/domain/registry/ui/server/admin/VerifyOteServlet.java
rename to java/com/google/domain/registry/tools/server/VerifyOteAction.java
index 43756727a..ebadc2480 100644
--- a/java/com/google/domain/registry/ui/server/admin/VerifyOteServlet.java
+++ b/java/com/google/domain/registry/tools/server/VerifyOteAction.java
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package com.google.domain.registry.ui.server.admin;
+package com.google.domain.registry.tools.server;
 
 import static com.google.common.base.Predicates.not;
 import static com.google.common.collect.Maps.toMap;
@@ -64,7 +64,9 @@ import com.google.domain.registry.model.eppinput.EppInput;
 import com.google.domain.registry.model.eppinput.EppInput.ResourceCommandWrapper;
 import com.google.domain.registry.model.host.HostCommand;
 import com.google.domain.registry.model.reporting.HistoryEntry;
-import com.google.domain.registry.security.JsonTransportServlet;
+import com.google.domain.registry.request.Action;
+import com.google.domain.registry.request.JsonActionRunner;
+import com.google.domain.registry.request.JsonActionRunner.JsonAction;
 
 import java.util.ArrayList;
 import java.util.EnumSet;
@@ -72,26 +74,35 @@ import java.util.List;
 import java.util.Map;
 
 import javax.annotation.Nonnull;
-import javax.servlet.http.HttpServletRequest;
+import javax.inject.Inject;
 
 /**
  * A servlet that verifies a registrar's OTE status. Note that this is eventually consistent, so
  * OT&amp;E commands that have been run just previously to verification may not be picked up yet.
  */
-public class VerifyOteServlet extends JsonTransportServlet {
+@Action(
+    path = VerifyOteAction.PATH,
+    method = Action.Method.POST,
+    xsrfProtection = true,
+    xsrfScope = "admin")
+public class VerifyOteAction implements Runnable, JsonAction {
 
-  public static final String XSRF_SCOPE = "admin";
+  public static final String PATH = "/_dr/admin/verifyOte";
 
-  public VerifyOteServlet() {
-    super(XSRF_SCOPE, true);
+  @Inject JsonActionRunner jsonActionRunner;
+  @Inject VerifyOteAction() {}
+
+  @Override
+  public void run() {
+    jsonActionRunner.run(this);
   }
 
   @Override
   @SuppressWarnings("unchecked")
-  public Map<String, Object> doJsonPost(HttpServletRequest req, Map<String, ?> params) {
-    final boolean summarize = Boolean.parseBoolean((String) params.get("summarize"));
+  public Map<String, Object> handleJsonRequest(Map<String, ?> json) {
+    final boolean summarize = Boolean.parseBoolean((String) json.get("summarize"));
     return toMap(
-        (List<String>) params.get("registrars"),
+        (List<String>) json.get("registrars"),
         new Function<String, Object>() {
           @Nonnull
           @Override
diff --git a/javatests/com/google/domain/registry/server/RegistryTestServer.java b/javatests/com/google/domain/registry/server/RegistryTestServer.java
index fd2b73244..ef8ad365d 100644
--- a/javatests/com/google/domain/registry/server/RegistryTestServer.java
+++ b/javatests/com/google/domain/registry/server/RegistryTestServer.java
@@ -84,9 +84,7 @@ public final class RegistryTestServer {
       route("/_dr/admin/registry/*",
           com.google.domain.registry.ui.server.admin.RegistryServlet.class),
       route("/_dr/admin/registrar/*",
-          com.google.domain.registry.ui.server.admin.RegistrarServlet.class),
-      route("/_dr/admin/verifyOte",
-          com.google.domain.registry.ui.server.admin.VerifyOteServlet.class));
+          com.google.domain.registry.ui.server.admin.RegistrarServlet.class));
 
   private final TestServer server;