Perhaps IsDeviceAPI may not be the best name here since we'll have permissions for not only W3C device APIs but also other APIs from sysapps or other groups.
Shall we ues IsValidPermission? And here, instead of checking the scheme, we could check it against a preloaded permission list.