DeepSeek's New Search API Hands Out Authority Scores — and Spam Gets Top Marks

DeepSeek opened its internal search engine to the public on Oct. 17, 2026 through a Search and Fetch API — and an independent test of 110 calls, costing roughly $0.08, found that PDFs titled "Free Robux Generator in 2025" hosted on a US government domain received the system's highest authority tier of 4, while the tester's own site scored 1.

The API matters because it exposes the retrieval layer that feeds DeepSeek's AI answers. SEOs can now query the index directly, inspect which sources surface, and read two scores attached to every result — something Google has never offered. The engine, which already powers search on DeepSeek's site and API, indexes hundreds of billions of pages and handles hundreds of millions of searches a day, according to the company's announcement.

Suganthan Suganthirajah, who published the original investigation, put the core tension plainly: "My site came back with an authority score of 1. Spam PDFs on government and university hosts came back with authority 4."

What Do the Two Scores Actually Mean?

Every result carries two fields. The first, authority, is a tier from 0 to 4 (-1 means unknown); the documentation says values of 3 or above indicate highly authoritative sources. The second, rerank_score, runs from 0 to 3 and combines relevance, authority and freshness, with 1.5 or above documented as high quality.

Across 20 SEO and GEO queries at count=50 — 1,000 results total — rerank scores ranged from 0.75 to 2.70 with a median of 1.63. Results sorted consistently by that score, and 68% cleared the 1.5 high-quality threshold. Only 196 distinct score values appeared across the 1,000 results, suggesting bucketing.

The authority distribution across all 4,322 results in the run:

• Authority 1: 2% of results, median rerank 0.95
• Authority 2: 32%, median rerank 1.45
• Authority 3: 60%, median rerank 1.83
• Authority 4: 6%, median rerank 1.98

Higher authority tiers correlated with higher rerank medians, though the tests cannot isolate authority's exact weight.

Is Authority a Page Score or a Host Score?

Despite the documentation calling it a page authority tier, 16 site: probes across 16 hosts showed every URL on a given host sharing one score:

• suganthan.com and growth-memo.com: authority 1
• ipullrank.com, brodieclark.com, medium.com, reddit.com: authority 2
• ahrefs.com, moz.com, searchengineland.com, aleydasolis.com, linkedin.com: authority 3
• zenodo.org: authority 4

The Reddit subdomains sharpen the finding: qh.reddit.com scored 1 while www.reddit.com scored 2, pointing to the host — not the registrable domain — as the scoring unit.

That host-level behavior explains the spam results. Webform uploads titled "BEST CBD GUMMIES EXPOSED" on business.columbia.edu received authority 4. A former UK MP's domain serving "Minimum Deposit Casinos UK" content ranked #2 for "best casino sites uk" with authority 3. DeepSeek says the engine filters SEO spam, GEO manipulation and low-quality AI content; these examples — confirmed observations from the test, not company statements — got through anyway, and the results don't show how much spam the filter did remove.

What Does This Change for Tool Publishers and Independent Sites?

Six target queries about the tester's own tools told a consistent story. His Gemini citations article ranked #48 with rerank 1.14; his FanoutFox Chrome extension ranked #32 with rerank 1.37. Four other queries left his site outside the top 50 entirely. Package registries and marketplaces dominated instead: PyPI, npm, Apify, Chrome Web Store, WordPress.org and GitHub hosts repeatedly surfaced at the top.

Both of his results fell below the documented 1.5 quality threshold. Directly relevant original content did not overcome a low authority tier — though these tests cannot quantify the tier's weighting.

How Does the Fetch API Behave?

Here the findings shift from search quality to crawler conduct, again based on observation rather than any DeepSeek statement. The Fetch requests did not identify as DeepSeek. They used a Firefox/149.0 user agent with an Accept-Language of zh-CN, carried no From header or bot token, and originated from five different IPs, all on AS136907 (Huawei Cloud, Hong Kong). Rendering tests loaded CSS but did not run JavaScript or load images.

The Fetch API also returned full content from three URLs disallowed for User-agent: * — httpbin.org/deny, Wikipedia's Special:Search and google.com/search. Whether the fetcher ever requests robots.txt remains unconfirmed.

The author's warning on log filtering is worth repeating: blocking the Firefox string alone catches legitimate browsers, and AS136907 is a general Huawei Cloud network, so not every request from it belongs to DeepSeek.

Practical Caveats for Testers

• Set localization explicitly. Omitting it behaved like using the caller's UAE IP. UK/US IPs changed rerank scores for 26–41 of 50 results and swapped 4–15 URLs, with a mean delta of roughly ±0.05.
• Date filters drop undated pages. 11% of unfiltered results had null dates and vanished under after:/before: filters. Returned dates ended in T16:00:00Z — midnight Beijing time.
• Field lengths exceed documentation. Snippets ran a median 301 characters against a documented 100–200; summaries about 3,570 against 600–800.
• Pricing: $0.75 per 1,000 successful requests for each API; failures, empty results and timeouts are not billed. Server-side calls made through Claude Code or Codex stay free until Nov. 1, 2026, 00:00 Beijing time.

The author frames the numbers as directional: one day, 110 calls, six target queries, one calling region. The open questions — whether authority weighting changes, whether robots.txt handling shifts, whether the spam filter tightens on parasite content — are exactly what SEOs with API keys should now monitor.