What the 2024 Google API leak actually told us.

On May 27, 2024, Mike King published one of the most detailed dissections of Google's ranking system ever made public. He did not have to break in. The internal documentation for Google's Content Warehouse API had been accidentally pushed to a public GitHub repository, googleapis/elixir-google-api, on March 27 and removed on May 7. By the time the deletion happened, an external documentation service had cached the entire schema. Apache 2.0 license. 14,014 attributes. 2,596 modules.

14,014

Ranking attributes exposed across 2,596 modules when Google's Content Warehouse API documentation accidentally went public.

Google API leak, May 2024

It is not a leak of training data or scoring weights. It is the equivalent of finding a parts catalog for an engine you have only ever heard running. You cannot see the tuning, but you can see exactly what parts exist.

What the leak actually contains

The schema names every module that participates in Google's pipeline, the attributes those modules read and write, and in many cases a one-line description of what each attribute is for. King grouped them into five functional layers.

The architecture matters because it shows that ranking is not one model. It is a pipeline. Mustang produces a base score, Ascorer feeds the candidate set, and then a series of Twiddlers reorder, boost, and demote. Each Twiddler is small, easy to ship, and easy to roll back. That is how Google can experiment quickly without rebuilding the index.

Five things Google denied that turned out to be true

The most widely-quoted finding from the leak is the gap between public statements and the schema.

"Lied is harsh, but it's the only accurate word to use here."

— Mike King, iPullRank

King's framing is sharp on purpose. The implication for content strategists is concrete: if you architected your program around the official narrative, parts of it are pointed at the wrong signals. Sites that were demoting click-friendly headlines because "clicks don't matter" were actively suppressing their own NavBoost score.

The signals that matter most (and why GEO inherits them)

Once you accept that the leaked schema is real, several signals jump from "speculative" to "load-bearing." They matter for classical SEO. They matter even more for GEO because AI engines that use Google Search Grounding (Gemini and indirectly Google AI Overviews) inherit the same retrieval and quality layers, and independent engines like ChatGPT and Perplexity reuse the underlying logic.

Site authority is real

The siteAuthority attribute lives inside Compressed Quality Signals, the same module that holds Panda demotions and other site-level adjustments. Two related attributes, homepagePagerankNs and homePageInfo (with trust levels NOT_HOMEPAGE, NOT_TRUSTED, PARTIALLY_TRUSTED, FULLY_TRUSTED), apply homepage authority to new pages on the same site.

The practical takeaway: building authority on your homepage and hub pages is not vanity. It is what gives every new page a head start on retrieval.

Clicks and engagement are reranking input

NavBoost is the click-based reranker. It uses goodClicks, badClicks, lastLongestClicks, unsquashedClicks (pre-normalized), and unicornClicks (clicks from a high-trust user segment). It runs on a 13-month rolling window. Reference query counts from NavBoost feed into Panda and other systems.

13 mo

Rolling click window NavBoost uses for reranking — despite years of public denials that clicks are a ranking signal.

Google API leak, May 2024

The implication for AI search: the same engagement attestation pulls a source into AI answers. If your pages get clicked and read, they get cited. If they get clicked and bounced, they get demoted, and they get less likely to be selected as a source in the first place.

Topical cohesion: siteFocusScore and siteRadius

The schema includes a topic embedding for each site. siteFocusScore measures how concentrated a site is around a topic. siteRadius measures how far each page deviates from that topic embedding. Unfocused sites get penalized. Niche authority gets rewarded.

Freshness has multiple date signals

Google does not pick one date for a document. It uses bylineDate (explicit publication date), syntacticDate (extracted from URL or title), semanticDate (content-derived estimate), and "last good click date" as a content decay signal. The presence of all four implies that the system actively distrusts a single declared date.

For AI search visibility: keeping dateModified in your JSON-LD aligned with actual content changes, and updating long-form pages on a real schedule, holds the freshness signal across both classical and AI pipelines.

Document truncation

The leak documents that Mustang caps token count and truncates documents past a threshold. The corollary: top-of-page placement of your most important claims is critical. A specific, quotable fact buried in section 11 may not even be in the indexed copy of the page.

This is also true for AI extraction. Models that pull passages preferentially weight earlier tokens. If your TL;DR contains the answer, it has a much higher chance of being lifted than a paragraph deep in the article.

The Panda formula, finally explainable

The leak made one thing visible that SEO professionals have been guessing at for over a decade: the Panda update is not a black box. It is approximately:

(Independent Links / Reference Queries) × Modifier

Calculated at domain, subdomain, and subdirectory level. Reference queries come from NavBoost's rolling click window. "Panda refreshes" are window updates: when the rolling window shifts, the ratio shifts, and some sites move.

That gives an interpretable definition of "low-quality site": one that has received many links but few queries that result in successful clicks, relative to its peers. The same definition translates almost word-for-word to AI search: a site that other sources reference but that users do not actually engage with is a site that retrieval systems eventually deprioritize.

What to change, concretely

Three actions transfer directly from the leak's findings to GEO performance.

1. Treat siteAuthority as real. Concentrate brand-building work where the leak says authority is calculated: the homepage, hub pages, and the trusted sub-sections that link out to deeper content. Do not rely on the homepage to rank for everything; rely on it to lend credit to everything else.
2. Optimize for engagement, not just clicks. lastLongestClicks measures post-click dwell. A high CTR with a fast bounce is a worse signal than a moderate CTR with long sessions. Restructure pages so users find what they came for early and stay longer.
3. Tighten topical cohesion. If siteRadius measures deviation from your topic embedding, every off-topic post pulls the radius wider. Either commit to a topic and prune drift, or split unrelated lines of business onto separate properties.

The leak did not invent any of these levers. It confirmed them. For BeCited audits, the most useful effect of the leak was that it ended the debate about whether engagement, authority, and topical cohesion matter. They are in the source code of the system. They matter for Google. And because every major AI engine reuses pieces of that pipeline, they matter for AI search.

Frequently asked questions