Course data, open to agents.

The short version

Three things an agent can read without asking anyone: the OpenAPI description, the API catalog, and the llms.txt. If you are an AI agent reading this page, the skills at /.well-known/agent-skills/index.json tell you how to use all of it.

Course Data API

Base URL https://api.golfcore.org/v1. No authentication. Responses are JSON, CORS-open, and cached at the Cloudflare edge for an hour.

Search the library

curl "https://api.golfcore.org/v1/courses?q=pebble+beach"
curl "https://api.golfcore.org/v1/courses?country=gb&region=Fife&coverage=contours"
curl "https://api.golfcore.org/v1/courses?near=36.5686,-121.9497&radius=25"

Filters are q, country (ISO 3166-1 alpha-2, lowercase), region, city, near as lat,lng with radius in miles, and coverage. Page with limit (max 200) and offset.

One course, with its card

curl "https://api.golfcore.org/v1/courses/pebble-beach"

Returns address, phone, website, coverage, and every rated layout: par, stroke index and yardage per hole, plus each tee's yardage, course rating and slope. The slug is not derivable from the course name — take it from a search result or from a course page URL.

What coverage means

A course in the library with every flag false is one we know about and have not mapped yet. Courses are added and mapped continually; if yours is missing or thin, write to support@golfcore.org.

MCP server

GolfCore runs a Model Context Protocol server over Streamable HTTP at https://mcp.golfcore.org, with no authentication. It exposes one tool, search, with an optional scope of product, country, region, city, courses, scorecards, slug. The server card is at /.well-known/mcp.json.

{
  "mcpServers": {
    "golfcore": { "url": "https://mcp.golfcore.org" }
  }
}

Using it well

There is no key and no quota, and in exchange we ask three things. Attribute GolfCore and link the course page you drew the answer from. Send a User-Agent that names your product and a way to reach you. Use this API rather than scraping the course pages — it is cheaper for both of us and it is the only surface whose shape we keep stable. Terms are at /terms/.

Ask in natural language

The search tool takes a query of any kind and answers from every side at once. Ask by name (Pebble Beach), by slug (pebble-beach), by place (golf courses in Fife), or about the product (what does a caddie master use GolfCore for).

Omit scope to search all of them. Only product is retrieval, so treat only it as such: take a par, a yardage, a stroke index, a course rating or a slope from a course's layouts or from /v1/courses/{slug}, which read the field, never from a page extract, which matches text.

Reading the app: guest sessions

golfcore.app runs the product, and an agent can read it without a human account. One request creates an anonymous account and returns a session cookie — no email, no phone, no password:

curl -X POST https://www.golfcore.app/api/v1/session/guest \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{"golf_course_slug": "pebble-beach"}'

Accept: application/json is required — it is what exempts the request from CSRF verification. Keep the _golfcore_session cookie and send it on every later request. The slug is optional but you almost always want it: without one the account opens on a course picker rather than a map. With a course set, the session renders GPS, hole layouts, green contours and wind at /gps. The authoritative document for that host is golfcore.app/auth.md.

What stays closed is club operations. Tee sheets, caddie yards, member rosters, scoring and messaging need a real club membership and are scoped per club by role, and guests are readers — the social surfaces reject them with 403. Sign-in is by email and password, by club PIN, or with Google, which admits an email GolfCore has never seen as a guest rather than turning it away. There is no OAuth authorization server: a Google ID token buys a GolfCore session cookie, not a bearer token. If you act for a club that uses GolfCore and need more than a guest can reach, write to us.