Check Consent

Returns the CURRENT status of the most recent decision for this principal + category, if any exists. identifier matches whatever was used to record consent for this principal -- an email (hosted consent page), a customer id (signed widget identity or the record API) or a device_id (embedded widget), since all are stored in the same principal_identifier field. category matches by NAME, case-insensitive, not by internal UUID -- a business's own backend code shouldn't need to hardcode OpenProof's category IDs.

allowed=False covers both an explicit rejection/withdrawal AND no record existing at all -- callers that need to distinguish "never asked" from "said no" should check status (null vs "rejected"/ "withdrawn"), not just allowed, since gating a real action on consent should default to false whenever there's any doubt.