Developer Portal
The Levy Fleets developer portal is where third-party developers register as vendors, build plugins, test them in sandbox, and submit them for marketplace review. It lives at /developers and is open to anyone — no application or sales call required.
Building a plugin is open to everyone
Solo developers, agencies, large vendors — anyone can register and submit. Levy Plugins is a public marketplace, not a curated partner program.
Who builds plugins
- Vendors with an existing product — Veriff, Cover Genius, Captur.ai built plugins because they already had a SaaS that fit. Plugin = distribution to Levy operators.
- Indie developers — fraud detection scoring, custom analytics, niche IoT integrations. Levy is a place to monetize a small focused tool.
- Agencies building for clients — agency-built plugins for a specific fleet customer can be listed as private or public.
- Existing Levy operators — sometimes a fleet builds an internal tool useful to other Levy customers and lists it.
What you need
To submit a plugin, you'll need:
- A vendor profile — name, support email, homepage, optional company logo
- A signed Plugin Partner Agreement — standard legal terms (24h breach notification, IP ownership, termination)
- A working webhook endpoint — HTTPS URL that accepts signed POST requests from Levy
- A
plugin.jsonmanifest — see schema below - Screenshots — at least one, recommended three (1280×800 PNG/JPG)
- A long description — Markdown content for the marketplace detail page
- (For paid plugins) Stripe Connect Express account — Levy will guide you through onboarding
The manifest
Every plugin ships a plugin.json (or .yaml) manifest. Full TypeScript shape:
type PluginManifest = {
slug: string; // 'my-fraud-tool' — lowercase, dash-separated, unique
version: string; // semver, e.g. '1.0.0'
name: string; // display name
vendor: {
name: string;
email: string;
url: string;
};
category: 'kyc' | 'insurance' | 'parking' | 'analytics'
| 'notifications' | 'iot' | 'payments' | 'workflow' | 'other';
description: string; // 1-2 sentences for cards
long_description_mdx?: string; // detail page body (Markdown)
screenshots: string[]; // CDN URLs
homepage: string;
support_url: string;
permissions: PluginPermission[];
webhook_subscriptions: LevyEvent[];
webhook_endpoint: string; // your URL Levy will POST to
config_schema: JSONSchema7; // rendered as a form during install
oauth?: {
authorize_url: string;
token_url: string;
scopes: string[];
};
pricing: PluginPricing;
ui_mounts?: UIMount[]; // v4 only
};
See Submitting a plugin for full schema reference and field-by-field examples.
Permissions you can request
Levy uses fine-grained, scoped permissions. Request only what you need — extra scopes hurt your approval rate and your operator install rate.
| Scope | Use case |
|---|---|
read:rides | Ride data without pricing |
read:rides.geo | GPS tracks and coordinates |
read:rides.financial | Pricing, fees, payouts |
write:rides.flags | Fraud flags, parking scores |
write:rides.tags | Categorization tags |
read:customers | Anonymized rider IDs |
read:customers.pii | Names, emails, phones — admin-class |
write:customers.tags | Tag riders (KYC status, etc.) |
write:customers.notes | Add operator notes |
read:vehicles | Fleet inventory |
write:vehicles.status | Lock / unlock — admin-class |
write:vehicles.notes | Maintenance notes |
read:payouts | Partner payout records |
read:zones | Zone definitions |
write:zones | Create/edit zones — admin-class |
read:webhooks | Event log replay |
The write:rides.cost permission does not exist. Plugins cannot mutate ride fares — that's reserved for Levy core to protect refund accounting. If you need to issue a refund, request the partnership team to add a refund-against-the-ride flow.
Events you can subscribe to
ride.created, ride.started, ride.ended, ride.cancelled, ride.adjusted
vehicle.status_changed, vehicle.battery_low, vehicle.offline
customer.created, customer.kyc_completed, customer.suspended
payment.captured, payment.refunded, payout.completed
zone.entered, zone.exited, zone.violation
support.ticket_created
Subscribe to the minimum set you need. Each event delivery is a POST to your webhook_endpoint with HMAC-SHA256 signature in the X-Levy-Signature header.
Sandbox
Before you submit, you'll get access to a sandbox subaccount with synthetic ride, vehicle, and customer data. Fire test events from the developer portal to verify your webhook endpoint, your config form rendering, and your auth flow.
Sandbox events are clearly marked with "environment": "sandbox" so you can branch your code.
Review queue and 5-day SLA
When you submit a plugin, it enters the Levy review queue. Our ops team reviews:
| Check | What we look at |
|---|---|
| Manifest validity | Schema compliance, valid JSON |
| Permission necessity | Are all requested scopes actually used? |
| Privacy posture | How is rider data handled, stored, deleted? |
| Webhook reliability | Does your endpoint respond correctly to test events? |
| Pricing fairness | Is the price in the reasonable range ($0–$999/mo or per-event)? |
| Vendor agreement | Signed and current? |
| Screenshots and description | Accurate, no misleading claims? |
5-day review SLA: we aim to give you a decision (approve, request changes, reject) within 5 business days. Most reviews complete in 2-3 days. You get email updates as the review progresses.
If we request changes, you can re-submit at any time and the SLA clock restarts. Re-submissions typically clear in 1-2 days.
Revenue share
Plugin vendors get 80% of gross plugin revenue; Levy collects a 20% platform fee. Marquee partners may negotiate down to 10% (Levy keeps less) for strategic value, or up to 30% for niche plugins where Levy provides significant customer acquisition.
Stripe Connect handles payouts. You onboard once during vendor registration. Monthly invoices generate automatically; payouts arrive 7 days after operator payment.
Post-launch obligations
Once your plugin is live:
- 24-hour breach notification SLA — if you have a security incident affecting Levy operators' data, notify us within 24 hours.
- Annual SOC 2 attestation — if you process PII, we ask for your SOC 2 report annually.
- Maintenance — keep your webhook endpoint healthy. Plugins with >7 days of continuous webhook failures are auto-disabled across all installs.
- Support response time — operators expect responses within 1 business day to your
support_url. - Version updates — patch and minor versions auto-upgrade for installed operators; major versions require operator re-consent.
Get started
- Submitting a plugin — full submission walkthrough
- Visit
/developersto register a vendor profile - Read the Plugin Partner Agreement before starting