feat: add API endpoint override for reverse proxy deployments

.changeset/api-endpoint-base-url.md

@@ -0,0 +1,5 @@
+---
+"@googleworkspace/cli": minor
+---
+
+Add an opt-in API endpoint base URL override via `GOOGLE_WORKSPACE_CLI_API_ENDPOINT_BASE_URL`.

.env.example

@@ -18,6 +18,9 @@
 # Override the config directory (default: ~/.config/gws)
 # GOOGLE_WORKSPACE_CLI_CONFIG_DIR=
 
+# Override the HTTP(S) base URL for Google API requests. Discovery documents are still fetched from Google.
+# GOOGLE_WORKSPACE_CLI_API_ENDPOINT_BASE_URL=https://proxy.example.com/
+
 # ── Model Armor (response sanitization) ──────────────────────────
 # Default Model Armor template (overridden by --sanitize flag)
 # GOOGLE_WORKSPACE_CLI_SANITIZE_TEMPLATE=

AGENTS.md

@@ -208,6 +208,7 @@ See [`src/helpers/README.md`](crates/google-workspace-cli/src/helpers/README.md)
 | Variable | Description |
 |---|---|
 | `GOOGLE_WORKSPACE_CLI_CONFIG_DIR` | Override the config directory (default: `~/.config/gws`) |
+| `GOOGLE_WORKSPACE_CLI_API_ENDPOINT_BASE_URL` | Optional HTTP(S) base URL override for Google API requests. Discovery documents are still fetched directly from Google. |
 
 ### OAuth Client
 

README.md

@@ -382,6 +382,7 @@ All variables are optional. See [`.env.example`](.env.example) for a copy-paste
 | `GOOGLE_WORKSPACE_CLI_CLIENT_ID` | OAuth client ID (alternative to `client_secret.json`) |
 | `GOOGLE_WORKSPACE_CLI_CLIENT_SECRET` | OAuth client secret (paired with `CLIENT_ID`) |
 | `GOOGLE_WORKSPACE_CLI_CONFIG_DIR` | Override config directory (default: `~/.config/gws`) |
+| `GOOGLE_WORKSPACE_CLI_API_ENDPOINT_BASE_URL` | Optional HTTP(S) base URL override for Google API requests |
 | `GOOGLE_WORKSPACE_CLI_SANITIZE_TEMPLATE` | Default Model Armor template |
 | `GOOGLE_WORKSPACE_CLI_SANITIZE_MODE` | `warn` (default) or `block` |
 | `GOOGLE_WORKSPACE_CLI_LOG` | Log level for stderr (e.g., `gws=debug`). Off by default. |
@@ -390,6 +391,20 @@ All variables are optional. See [`.env.example`](.env.example) for a copy-paste
 
 Environment variables can also be set in a `.env` file (loaded via [dotenvy](https://crates.io/crates/dotenvy)).
 
+### API Endpoint Override
+
+Set `GOOGLE_WORKSPACE_CLI_API_ENDPOINT_BASE_URL` to override the base URL used for Discovery-driven Google API requests, for example when routing calls through an internal reverse proxy or API gateway:
+
+```bash
+export GOOGLE_WORKSPACE_CLI_API_ENDPOINT_BASE_URL=https://proxy.example.com/
+```
+
+Only API request endpoints from Discovery documents are rewritten. Discovery documents themselves are still fetched directly from Google, and cached Discovery JSON remains the original Google document so the endpoint override can be enabled or disabled without clearing the cache. The rewrite replaces the scheme, host, and port while preserving the Google API path, for example `https://www.googleapis.com/drive/v3/files` becomes `https://proxy.example.com/drive/v3/files`. Any path in the configured base URL itself is not prepended.
+
+This is separate from standard `http_proxy` / `https_proxy` forward proxy support and does not rewrite OAuth authorization or token endpoints.
+
+Some services share the same path prefix in Discovery, such as Analytics Admin and Analytics Data both using `/v1beta/`. In those cases, a proxy may need its own routing rules beyond path inspection.
+
 ## Exit Codes
 
 `gws` uses structured exit codes so scripts can branch on the failure type without parsing error output.

crates/google-workspace-cli/src/helpers/script.rs

@@ -169,13 +169,8 @@ fn process_file(path: &Path) -> Result<Option<serde_json::Value>, GwsError> {
             filename.trim_end_matches(".js").trim_end_matches(".gs"),
         ),
         "html" => ("HTML", filename.trim_end_matches(".html")),
-        "json" => {
-            if filename == "appsscript.json" {
-                ("JSON", "appsscript")
-            } else {
-                return Ok(None);
-            }
-        }
+        "json" if filename == "appsscript.json" => ("JSON", "appsscript"),
+        "json" => return Ok(None),
         _ => return Ok(None),
     };
 

crates/google-workspace-cli/src/main.rs

@@ -484,6 +484,9 @@ fn print_usage() {
     println!(
         "    GOOGLE_WORKSPACE_CLI_CONFIG_DIR          Override config directory (default: ~/.config/gws)"
     );
+    println!(
+        "    GOOGLE_WORKSPACE_CLI_API_ENDPOINT_BASE_URL      HTTP(S) base URL override for API requests"
+    );
     println!(
         "    GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND     Keyring backend: keyring (default) or file"
     );

crates/google-workspace/Cargo.toml

@@ -38,3 +38,4 @@ tracing = "0.1"
 [dev-dependencies]
 serial_test = "3.4.0"
 tempfile = "3"
+tokio = { version = "1", features = ["macros", "rt"] }