An Aura/API surface is the set of Salesforce requests and endpoints exposed by the Aura framework and related APIs that a site can call. In portal-hunting contexts, security teams use the term to describe the request paths a guest user can reach on an Experience Cloud site, including calls that return page data, search results, records, or content.
This surface matters because public portals often rely on configuration, not secrecy, to limit access. If guest permissions are too broad, an attacker can enumerate endpoints, test which parameters are accepted, and retrieve more data than intended without logging in. Defenders review the Aura/API surface by checking guest-user permissions, reducing exposed components, and monitoring for repeated low-and-slow requests, unusual parameter probing, and automated content harvesting from anonymous sessions.