DeepSeek Opens Its Search API: Authority Scores, Spam Leaks, $0.08 Test

By James Calloway

For $0.08, independent tester Suganthan ran 110 calls against DeepSeek's newly public Search and Fetch API and found his own site scored authority 1 — while "Free Robux Generator" PDFs hosted on a US government domain scored 4.

DeepSeek announced the Search and Fetch API on Oct. 17, 2026, alongside an update to its Flash model. The company says the engine already powers search on its website and API, indexes hundreds of billions of pages and handles hundreds of millions of searches a day. It claims to filter out SEO spam, GEO manipulation and low-quality AI content. The test results say that filter leaks.

The test run covered 93 Search calls and 17 Fetch calls, made from Dubai on Oct. 17, 2026. Around 103 were billable at $0.75 per 1,000 requests, costing roughly $0.08 in total.

What does the API actually return?

Every result carries two scores. The authority field runs from 0 to 4, with -1 meaning unknown; DeepSeek's documentation says values of 3 or above indicate highly authoritative sources. The rerank_score runs from 0 to 3 and blends relevance, authority and freshness, with 1.5 or above counted as high quality.

Across 20 SEO and GEO queries at count=50, the tester collected 1,000 results:

• Rerank scores ranged from 0.75 to 2.70, with a median of 1.63
• 68% scored 1.5 or above
• Only 196 distinct score values appeared — the scores look bucketed
• Authority tiers -1 and 0 never appeared across all 4,322 results in the run

Higher authority tiers came with higher median rerank scores: authority 1 had a median of 0.95, authority 3 sat at 1.83 and authority 4 at 1.98.

Is authority a page score or a host score?

The documentation calls it a page-level tier. The tests say otherwise. Across 16 site: probes on 16 hosts, every URL returned for a host carried the same authority score:

• suganthan.com — authority 1
• medium.com, reddit.com, ipullrank.com, brodieclark.com — authority 2
• ahrefs.com, moz.com, searchengineland.com, linkedin.com — authority 3
• zenodo.org — authority 4

The Reddit subdomains make the case sharper: qh.reddit.com scored 1 while www.reddit.com scored 2. The host, not the registrable domain, appears to be the scoring unit. That matters because a host-wide score lets parasite content inherit a legitimate host's authority.

Did the spam filter hold up?

No. Three examples got through with top-tier scores:

• oig.dc.gov — webform PDFs titled "Free Robux Generator in 2025," authority 4, rerank 1.42
• business.columbia.edu — uploads titled "BEST CBD GUMMIES EXPOSED: The 'Forbidden' Gummy…", authority 4, rerank 1.50
• damiangreen.co.uk — a former MP's domain serving "Minimum Deposit Casinos UK," authority 3, ranked #2 for "best casino sites uk"

Self-published "frameworks" on zenodo.org also received authority 4 and ranked #1 and #3 for "generative engine optimization." The results don't show how much spam DeepSeek removed — they show these examples survived, and that a high authority tier wasn't a reliable judgement of page quality.

Where did original content rank?

Six target queries, run at count=50 from the UAE, tell the story. A Gemini citations article ranked #48 with rerank 1.14. FanoutFox, a Chrome extension, ranked #32 with rerank 1.37 — and fell outside the top 50 under UK or US localization. Four other tool queries left the tester's site outside the top 50 entirely.

Who won instead? Package registries and marketplaces: PyPI, npm, Apify, the Chrome Web Store, WordPress.org and GitHub surfaced repeatedly at the top. Both of the tester's results sat below DeepSeek's documented 1.5 high-quality threshold.

Being indexed wasn't enough. Direct relevance to the query didn't beat a higher-authority host.

What did the Fetch API do?

The fetcher did not identify itself as DeepSeek. Requests used a Firefox user agent (Firefox/149.0), an Accept-Language of zh-CN, and came from five different IPs on AS136907, Huawei Cloud, Hong Kong. There was no From header, bot token or signature.

The fetcher loaded CSS but did not run JavaScript, load images or fire XHR beacons. It also returned full content from three URLs disallowed by robots.txt for User-agent: * — httpbin.org/deny, Wikipedia's Special:Search and google.com/search. The tester could not confirm whether the fetcher ever requested robots.txt. These observations cover the Fetch API, not the crawler that builds DeepSeek's index.

One caveat for anyone planning to block: the Firefox string alone catches real browsers, and AS136907 is a general Huawei Cloud network. The tester suggests matching the combination of Firefox/149.0, zh-CN and AS136907, then verifying before treating hits as DeepSeek.

What should marketers take away?

Three practical findings stand out. Localization: omitting the field defaulted to the caller's IP; switching between UAE, UK, US and Chinese IPs changed rerank scores on 26 to 41 of 50 results and swapped 4 to 15 URLs. Date filters: after: and before: removed every undated page — 11% of unfiltered results had null dates, and those vanished under filtering. Field lengths: median snippets ran 301 characters and summaries about 3,570, both well beyond documented ranges.

The tester's checklist for SEOs: run target queries against the search endpoint and record rank, rerank score and authority together; check your tier with site: probes including subdomains; set localization explicitly; add machine-readable dates and verify DeepSeek reads them; and test legitimate listings on PyPI, npm, GitHub and the Chrome Web Store alongside your own site.

This was one day, 110 calls, six target queries and one calling region. Treat the numbers as directional. But visible authority tiers, weak rankings for original tool content and top-tier scores for obvious spam now give the industry specific, testable questions — and at $0.75 per 1,000 requests, running those tests costs less than a coffee.