<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Consent Management — API Reference

## Define Purposes

```bash
node scripts/agent.js --action define-purposes \
  --purposes '[{"id":"analytics","name":"Analytics","required":false}]'
```

## Record Consent

```bash
node scripts/agent.js --action record \
  --subject-id "USER_ID" --granted "essential,analytics" \
  --denied "marketing" --policy-version "v2.1"
```

## Validate Consent

```bash
node scripts/agent.js --action validate \
  --subject-id "USER_ID" --purpose "marketing"
```

## Withdraw Consent

```bash
node scripts/agent.js --action withdraw \
  --subject-id "USER_ID" --purpose "analytics"
```

## Check GPC Signal

```bash
node scripts/agent.js --action check-gpc \
  --headers '{"Sec-GPC": "1"}'
```

## CCPA Opt-Out

```bash
node scripts/agent.js --action ccpa-optout \
  --subject-id "USER_ID" --sale-categories "advertising,analytics"
```

## GDPR Consent Validity Checklist

| Requirement | Article | Check |
|-------------|---------|-------|
| Freely given | Art. 7(4) | No bundling with service |
| Specific | Recital 32 | Per-purpose granularity |
| Informed | Art. 13/14 | Controller identity + purposes |
| Unambiguous | Recital 32 | Affirmative action required |
| Withdrawable | Art. 7(3) | As easy to withdraw as to give |
| Documented | Art. 7(1) | Controller can demonstrate consent |

## Consent Lifecycle States

| State | Description | Trigger |
|-------|-------------|---------|
| pending | Consent not yet collected | First visit |
| granted | Purpose explicitly accepted | User opt-in |
| denied | Purpose explicitly refused | User opt-out |
| withdrawn | Previously granted, now revoked | Withdrawal request |
| expired | Consent exceeded retention period | Time-based |
