POST your CI/CD deploys to a signed webhook. When Radar opens an investigation, it scans the last 2 hours of deploys for that service and attaches the most likely culprit — with a confidence score based on how close the deploy was to the incident start.

POST /api/public/deploys/{workspaceId}{ "version": "v3.42.1", "service_slug": "acme-payments", "deployed_at": "2026-05-12T14:19:11Z", "metadata": { "git_sha": "9f8e7d6c", "git_message": "refactor: stripe webhook handler", "deployed_by": "github-actions", "environment": "production" }, "dedupe_key": "github:9f8e7d6c" }
header · hmac-sha256x-deploy-signature: 3a6f...c9b2
The deploy chip appears on every investigation. No more #deploys archaeology at 3 a.m.
<10 min = high. <30 min = medium. <2h = low. So you know how seriously to take the link.
Same-service deploys outrank workspace-wide events. The right culprit gets surfaced.
Workspace admin generates an HMAC secret in settings. Store it in your CI.
Add one curl to your release pipeline — GitHub Actions, GitLab CI, Argo, anything.
Every investigation now shows "Correlated deploy" with the version, sha, and confidence.