Scorsync developer resources

Scorsync publishes live and final gymnastics competition results — USA Gymnastics trampoline, double mini and tumbling, plus rhythmic and acrobatic gymnastics. This page is the index of every Scorsync API, authentication scheme and machine-readable file, for developers building an integration and for AI agents working out what they are allowed to ask for.

Machine-readable files

Scorsync developer resources

https://scorsync.com/developers

Index of every Scorsync API, authentication scheme and machine-readable file.

Scorsync OpenAPI 3.1 specification

https://scorsync.com/openapi.json

Machine-readable description of the Scorsync HTTP API, including every security scheme and OAuth scope.

OAuth 2.0 authorization server metadata

https://scorsync.com/.well-known/oauth-authorization-server

RFC 8414 metadata for the Scorsync authorization server: endpoints, supported scopes and PKCE methods.

Scorsync llms.txt

https://scorsync.com/llms.txt

Entry point for AI agents and LLM-powered clients, in the llmstxt.org format.

Scorsync sitemap

https://scorsync.com/sitemap.xml

XML sitemap of the stable public pages on scorsync.com.

API surfaces and the credential each one needs

Access to Scorsync is scoped. There is no single all-powerful key: each surface takes its own credential, and a credential issued for one surface unlocks nothing else. Ask for the narrowest one that does your job.

None

Public read endpoints

Athlete, meet and club search plus the release feed, under /api. No credential required; rate limited.

OAuth 2.0 authorization code with PKCE (S256)

Coach-authorized OAuth 2.0 API

Authorization-code + PKCE flow at /oauth/authorize and /api/oauth/token. The issued bearer token carries only the scopes the coach consented to: profile, club.roster, results.read.

Bearer token with scoped abilities

Personal access tokens

Bearer tokens issued by POST /api/sanctum/token. Each token carries an explicit list of abilities, and endpoints check the ability they need rather than accepting any valid token.

Bearer token with the "mcp" ability

Model Context Protocol server

The Scorsync MCP server is mounted at /mcp/admin and requires a bearer token holding the "mcp" ability. A stdio server is also published for local MCP clients.

X-Gympass-Token service token

Partner integration endpoints

Server-to-server reads under /api/integrations for approved partners, authenticated with a per-partner service token header.

X-Meet-Token meet token

Meet-scoped ingest endpoints

Live score ingest for a single competition, authenticated with a meet token that only unlocks the meet it was issued for.

OAuth 2.0 scopes

Coach-authorized clients use the authorization code flow with PKCE. The coach approves a consent screen listing exactly the scopes below, and the issued bearer token carries only those — a token granted profile alone can never read a roster. Endpoints check the scope they need rather than accepting any valid token.

Scope	Grants access to
`profile`	Your name, email address and club affiliation
`club.roster`	The athletes on your club roster
`results.read`	Competition results for those athletes

Authorization endpoint: https://scorsync.com/oauth/authorize
Token endpoint: https://scorsync.com/api/oauth/token
PKCE is mandatory — code_challenge_method=S256.
redirect_uri must exactly match a registered value; there is no dynamic client registration.
Machine-readable metadata: /.well-known/oauth-authorization-server

Personal access tokens and abilities

POST /api/sanctum/token issues a bearer token for an account. Every token is minted with an explicit list of abilities and endpoints check the ability they require, so a token issued for one job cannot be replayed against another. The Scorsync MCP server at /mcp/admin, for example, rejects any token that does not hold the mcp ability, and its own tools are tiered read, write and destructive with confirmation required before anything is written.

Behaviour automated clients can rely on

Every public page is server-rendered: an agent that does not run JavaScript still reads real content.
A path that does not exist returns a real HTTP 404, never a 200 app shell.
A 404 for a client that did not ask for HTML comes back as a short markdown body pointing at this page, the sitemap and llms.txt.
Errors carry the status code that describes them: 401 for a missing credential, 403 for a credential that lacks the scope, 422 for validation.
List endpoints are paginated with Laravel's length-aware paginator: rows under data, with current_page, last_page, per_page and total.

Public pages

Scorsync — live gymnastics meet results — Live and final scores for trampoline, double mini, tumbling, rhythmic and acrobatic gymnastics competitions.
Meets — Every competition published on Scorsync, live, upcoming and concluded.
Athletes — Athlete profiles with competition history, personal bests and qualification scores.
Clubs — Club pages with rosters, team results, qualification and mobility tabs.
Rankings — Season rankings by event, level and age group.
Qualifications — Qualification and mobility score lookups for USA Gymnastics T&T athletes.
Tools — Downloads and utilities for meet directors, judges and coaches.
FAQ — How Scorsync works for spectators, coaches and meet directors.
About Scorsync — Product overview for meet hosts, clubs and federations.
What's new — Release notes for the Scorsync web and mobile apps.
Scorsync developer resources — API reference, OAuth scopes, MCP server and machine-readable files.