advanced
plugins
developer-portal
manifest

Developer Portal

Build and publish plugins for the Levy Fleets marketplace. Manifest schema, sandbox, submission process, and 5-day review SLA.

Levy Fleets TeamMay 18, 20268 min read

Developer Portal

The Levy Fleets developer portal is where third-party developers register as vendors, build plugins, test them in sandbox, and submit them for marketplace review. It lives at /developers and is open to anyone — no application or sales call required.

Building a plugin is open to everyone

Solo developers, agencies, large vendors — anyone can register and submit. Levy Plugins is a public marketplace, not a curated partner program.

Who builds plugins

  • Vendors with an existing product — Veriff, Cover Genius, Captur.ai built plugins because they already had a SaaS that fit. Plugin = distribution to Levy operators.
  • Indie developers — fraud detection scoring, custom analytics, niche IoT integrations. Levy is a place to monetize a small focused tool.
  • Agencies building for clients — agency-built plugins for a specific fleet customer can be listed as private or public.
  • Existing Levy operators — sometimes a fleet builds an internal tool useful to other Levy customers and lists it.

What you need

To submit a plugin, you'll need:

  1. A vendor profile — name, support email, homepage, optional company logo
  2. A signed Plugin Partner Agreement — standard legal terms (24h breach notification, IP ownership, termination)
  3. A working webhook endpoint — HTTPS URL that accepts signed POST requests from Levy
  4. A plugin.json manifest — see schema below
  5. Screenshots — at least one, recommended three (1280×800 PNG/JPG)
  6. A long description — Markdown content for the marketplace detail page
  7. (For paid plugins) Stripe Connect Express account — Levy will guide you through onboarding

The manifest

Every plugin ships a plugin.json (or .yaml) manifest. Full TypeScript shape:

type PluginManifest = {
  slug: string;                    // 'my-fraud-tool' — lowercase, dash-separated, unique
  version: string;                 // semver, e.g. '1.0.0'
  name: string;                    // display name
  vendor: {
    name: string;
    email: string;
    url: string;
  };
  category: 'kyc' | 'insurance' | 'parking' | 'analytics'
          | 'notifications' | 'iot' | 'payments' | 'workflow' | 'other';
  description: string;             // 1-2 sentences for cards
  long_description_mdx?: string;   // detail page body (Markdown)
  screenshots: string[];           // CDN URLs
  homepage: string;
  support_url: string;
  permissions: PluginPermission[];
  webhook_subscriptions: LevyEvent[];
  webhook_endpoint: string;        // your URL Levy will POST to
  config_schema: JSONSchema7;      // rendered as a form during install
  oauth?: {
    authorize_url: string;
    token_url: string;
    scopes: string[];
  };
  pricing: PluginPricing;
  ui_mounts?: UIMount[];           // v4 only
};

See Submitting a plugin for full schema reference and field-by-field examples.

Permissions you can request

Levy uses fine-grained, scoped permissions. Request only what you need — extra scopes hurt your approval rate and your operator install rate.

ScopeUse case
read:ridesRide data without pricing
read:rides.geoGPS tracks and coordinates
read:rides.financialPricing, fees, payouts
write:rides.flagsFraud flags, parking scores
write:rides.tagsCategorization tags
read:customersAnonymized rider IDs
read:customers.piiNames, emails, phones — admin-class
write:customers.tagsTag riders (KYC status, etc.)
write:customers.notesAdd operator notes
read:vehiclesFleet inventory
write:vehicles.statusLock / unlock — admin-class
write:vehicles.notesMaintenance notes
read:payoutsPartner payout records
read:zonesZone definitions
write:zonesCreate/edit zones — admin-class
read:webhooksEvent log replay

The write:rides.cost permission does not exist. Plugins cannot mutate ride fares — that's reserved for Levy core to protect refund accounting. If you need to issue a refund, request the partnership team to add a refund-against-the-ride flow.

Events you can subscribe to

ride.created, ride.started, ride.ended, ride.cancelled, ride.adjusted
vehicle.status_changed, vehicle.battery_low, vehicle.offline
customer.created, customer.kyc_completed, customer.suspended
payment.captured, payment.refunded, payout.completed
zone.entered, zone.exited, zone.violation
support.ticket_created

Subscribe to the minimum set you need. Each event delivery is a POST to your webhook_endpoint with HMAC-SHA256 signature in the X-Levy-Signature header.

Sandbox

Before you submit, you'll get access to a sandbox subaccount with synthetic ride, vehicle, and customer data. Fire test events from the developer portal to verify your webhook endpoint, your config form rendering, and your auth flow.

Sandbox events are clearly marked with "environment": "sandbox" so you can branch your code.

Review queue and 5-day SLA

When you submit a plugin, it enters the Levy review queue. Our ops team reviews:

CheckWhat we look at
Manifest validitySchema compliance, valid JSON
Permission necessityAre all requested scopes actually used?
Privacy postureHow is rider data handled, stored, deleted?
Webhook reliabilityDoes your endpoint respond correctly to test events?
Pricing fairnessIs the price in the reasonable range ($0–$999/mo or per-event)?
Vendor agreementSigned and current?
Screenshots and descriptionAccurate, no misleading claims?

5-day review SLA: we aim to give you a decision (approve, request changes, reject) within 5 business days. Most reviews complete in 2-3 days. You get email updates as the review progresses.

If we request changes, you can re-submit at any time and the SLA clock restarts. Re-submissions typically clear in 1-2 days.

Revenue share

Plugin vendors get 80% of gross plugin revenue; Levy collects a 20% platform fee. Marquee partners may negotiate down to 10% (Levy keeps less) for strategic value, or up to 30% for niche plugins where Levy provides significant customer acquisition.

Stripe Connect handles payouts. You onboard once during vendor registration. Monthly invoices generate automatically; payouts arrive 7 days after operator payment.

Post-launch obligations

Once your plugin is live:

  • 24-hour breach notification SLA — if you have a security incident affecting Levy operators' data, notify us within 24 hours.
  • Annual SOC 2 attestation — if you process PII, we ask for your SOC 2 report annually.
  • Maintenance — keep your webhook endpoint healthy. Plugins with >7 days of continuous webhook failures are auto-disabled across all installs.
  • Support response time — operators expect responses within 1 business day to your support_url.
  • Version updates — patch and minor versions auto-upgrade for installed operators; major versions require operator re-consent.

Get started