It's not only for device APIs permission, but also for cross origin access control, if set the permissions field like:
```
"permissions" : ["http://sample.com"],
```
It means that granting the access permission to the other origin "sample.com" with "http" as it's scheme.