Webhook error after update to 11.0.9

[raultak]

Code of Conduct

• I agree to follow this project's Code of Conduct

Disable plugins

• I reproduce the issue with all plugins disabled

Is there an existing issue for this?

• I have searched the existing issues

Version

11.0.9

Bug description

After update GLPI to 11.0.9 webhooks for item type "Assistance - Ticket approval", event "Update" are not working anymore.

An error occurred raising "Update" webhook for item Ticket approval (ID <####>)

Relevant log output

[2026-09-16 23:27:15] glpi.WARNING:   *** Warning: Undefined array key "itemtype" at Webhook.php line 634
  Backtrace :
  ./src/Webhook.php:634                              
  ./src/Webhook.php:547                              Webhook->addParentItemData()
  ./src/Webhook.php:1226                             Webhook->getWebhookBody()
  ./src/CommonDBTM.php:1834                          Webhook::raise()
  ./front/commonitilvalidation.form.php:121          CommonDBTM->update()
  ./front/ticketvalidation.form.php:40               include()
  ...Glpi/Controller/LegacyFileLoadController.php:64 require()
  ./vendor/symfony/http-kernel/HttpKernel.php:181    Glpi\Controller\LegacyFileLoadController->__invoke()
  ./vendor/symfony/http-kernel/HttpKernel.php:76     Symfony\Component\HttpKernel\HttpKernel->handleRaw()
  ./vendor/symfony/http-kernel/Kernel.php:208        Symfony\Component\HttpKernel\HttpKernel->handle()
  ./src/Glpi/Kernel/Kernel.php:201                   Symfony\Component\HttpKernel\Kernel->handle()
  ./public/index.php:78                              Glpi\Kernel\Kernel->handle()

[2026-09-16 23:27:15] glpi.WARNING:   *** Warning: Undefined array key "items_id" at Webhook.php line 635
  Backtrace :
  ./src/Webhook.php:635                              
  ./src/Webhook.php:547                              Webhook->addParentItemData()
  ./src/Webhook.php:1226                             Webhook->getWebhookBody()
  ./src/CommonDBTM.php:1834                          Webhook::raise()
  ./front/commonitilvalidation.form.php:121          CommonDBTM->update()
  ./front/ticketvalidation.form.php:40               include()
  ...Glpi/Controller/LegacyFileLoadController.php:64 require()
  ./vendor/symfony/http-kernel/HttpKernel.php:181    Glpi\Controller\LegacyFileLoadController->__invoke()
  ./vendor/symfony/http-kernel/HttpKernel.php:76     Symfony\Component\HttpKernel\HttpKernel->handleRaw()
  ./vendor/symfony/http-kernel/Kernel.php:208        Symfony\Component\HttpKernel\HttpKernel->handle()
  ./src/Glpi/Kernel/Kernel.php:201                   Symfony\Component\HttpKernel\Kernel->handle()
  ./public/index.php:78                              Glpi\Kernel\Kernel->handle()

[2026-09-16 23:27:15] glpi.ERROR:   *** Caught TypeError: Webhook::getAPISchemaBySupportedItemtype(): Argument #1 ($itemtype) must be of type string, null given, called in ./src/Webhook.php on line 643
  Backtrace :
  ./src/Webhook.php:931                              
  ./src/Webhook.php:643                              Webhook::getAPISchemaBySupportedItemtype()
  ./src/Webhook.php:547                              Webhook->addParentItemData()
  ./src/Webhook.php:1226                             Webhook->getWebhookBody()
  ./src/CommonDBTM.php:1834                          Webhook::raise()
  ./front/commonitilvalidation.form.php:121          CommonDBTM->update()
  ./front/ticketvalidation.form.php:40               include()
  ...Glpi/Controller/LegacyFileLoadController.php:64 require()
  ./vendor/symfony/http-kernel/HttpKernel.php:181    Glpi\Controller\LegacyFileLoadController->__invoke()
  ./vendor/symfony/http-kernel/HttpKernel.php:76     Symfony\Component\HttpKernel\HttpKernel->handleRaw()
  ./vendor/symfony/http-kernel/Kernel.php:208        Symfony\Component\HttpKernel\HttpKernel->handle()
  ./src/Glpi/Kernel/Kernel.php:201                   Symfony\Component\HttpKernel\Kernel->handle()
  ./public/index.php:78                              Glpi\Kernel\Kernel->handle()

Page URL

https://<glpi_address>/front/ticket.form.php?id=<ticket_id>

Steps To reproduce

1. Create a webhook for item type "Assistance - Ticket approval" and event "Update".
2. Create a ticket and request approval for a user or group.
3. Approve the request.
4. It's returned an error pop-up message: "An error occurred raising "Update" webhook for item Ticket approval (ID <####>)"

Your GLPI setup information

GLPI information

GLPI: 11.0.9 ( => /var/www/glpi)
Installation mode: TARBALL
Current language: en_US

Server

Operating system: Linux 6.1.0-53-amd64 #​1 SMP PREEMPT_DYNAMIC Debian 6.1.187-1 (2026-09-07) x86_64

PHP: 8.2.33 apache2handler
PHP extensions: Core, date, libxml, openssl, pcre, zlib, filter, hash, json, random, Reflection, SPL, session, standard, sodium, apache2handler, mysqlnd, PDO, xml, apcu, bcmath, bz2, calendar, ctype, curl, dom, mbstring, FFI, fileinfo, ftp, gd, gettext, iconv, igbinary, intl, ldap, exif, mysqli, pdo_mysql, Phar, posix, readline, redis, shmop, SimpleXML, soap, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, xmlreader, xmlrpc, xmlwriter, xsl, zip, Zend OPcache
Setup: disable_functions="" max_execution_time="30" max_input_vars="1000" memory_limit="512M" post_max_size="50M" session.cookie_secure="1" session.cookie_httponly="1" session.cookie_samesite="" session.save_handler="files" upload_max_filesize="48M"
Web server: Apache/2.4.68 (Debian)
User agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
Database:
Server Software: Debian 12
Server Version: 10.11.18-MariaDB-0+deb12u1
Server SQL Mode: STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION
Parameters: glpi@localhost/glpihml
Host info: Localhost via UNIX socket
Requirements:

PHP version (8.2.33) is supported.

OS and PHP are relying on 64 bits integers.

Sessions configuration is OK.

Allocated memory is sufficient.

Following extensions are installed: dom, fileinfo, filter, libxml, simplexml, tokenizer, xmlreader, xmlwriter.

mysqli extension is installed

curl extension is installed

gd extension is installed

intl extension is installed

mbstring extension is installed

zlib extension is installed

bcmath extension is installed

The constant SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES is present.

openssl extension is installed

Database engine version (10.11.18) is supported.

The log file has been created successfully.

Write access to /var/lib/glpi/files/_cache has been validated.

Write access to /var/lib/glpi/files/_cron has been validated.

Write access to /var/lib/glpi/files has been validated.

Write access to /var/lib/glpi/files/_graphs has been validated.

Write access to /var/lib/glpi/files/_lock has been validated.

Write access to /var/lib/glpi/files/_pictures has been validated.

Write access to /var/lib/glpi/files/_plugins has been validated.

Write access to /var/lib/glpi/files/_rss has been validated.

Write access to /var/lib/glpi/files/_sessions has been validated.

Write access to /var/lib/glpi/files/_tmp has been validated.

Write access to /var/lib/glpi/files/_uploads has been validated.

Security key files are accessibles.
Sessions configuration is secured.

exif extension is installed

ldap extension is installed

Following extensions are installed: bz2, Phar, zip.

Zend OPcache extension is installed

Following extensions are installed: ctype, iconv, sodium.

Write access to /var/lib/glpi/marketplace has been validated.

Timezones seems loaded in database.

GLPI constants

GLPI_ROOT: "/var/www/glpi"

GLPI_VERSION: "11.0.9"

GLPI_SCHEMA_VERSION: "11.0.9@7b129479687ebafebb6966eaa1d72cb683390613"

GLPI_FILES_VERSION: "11.0.9-e391d765"

GLPI_MIN_PHP: "8.2"

GLPI_MAX_PHP: "8.5"

GLPI_YEAR: "2026"

GLPI_I18N_DIR: "/var/www/glpi/locales"

GLPI_CONFIG_DIR: "/etc/glpi/"

GLPI_VAR_DIR: "/var/lib/glpi/files"

GLPI_LOG_DIR: "/var/log/glpi"

GLPI_MARKETPLACE_DIR: "/var/lib/glpi/marketplace"

GLPI_ENVIRONMENT_TYPE: "production"

GLPI_ALLOW_IFRAME_IN_RICH_TEXT: false

GLPI_DISALLOWED_UPLOADS_PATTERN: "/\.(php\d*|phar)$/i"

GLPI_TELEMETRY_URI: "https://telemetry.glpi-project.org"

GLPI_INSTALL_MODE: "TARBALL"

GLPI_NETWORK_MAIL: "glpi@teclib.com"

GLPI_NETWORK_SERVICES: "https://services.glpi-network.com"

GLPI_MARKETPLACE_ENABLE: 3

GLPI_MARKETPLACE_PRERELEASES: false

GLPI_MARKETPLACE_ALLOW_OVERRIDE: true

GLPI_MARKETPLACE_MANUAL_DOWNLOADS: true

GLPI_USER_AGENT_EXTRA_COMMENTS: ""

GLPI_DOCUMENTATION_ROOT_URL: "https://links.glpi-project.org"

GLPI_DISABLE_ONLY_FULL_GROUP_BY_SQL_MODE: "1"

GLPI_LOG_LVL: "warning"

GLPI_SKIP_UPDATES: false

GLPI_STRICT_ENV: false

GLPI_AJAX_DASHBOARD: "1"

GLPI_CALDAV_IMPORT_STATE: 0

GLPI_CENTRAL_WARNINGS: "1"

GLPI_SYSTEM_CRON: false

GLPI_TEXT_MAXSIZE: "4000"

GLPI_WEBHOOK_ALLOW_RESPONSE_SAVING: "0"

GLPI_WEBHOOK_CRA_MANDATORY: false

GLPI_ALTCHA_MODE: "interactive"

GLPI_ALTCHA_MAX_NUMBER: 50000

GLPI_ALTCHA_EXPIRATION_INTERVAL: "PT20M"

GLPI_DOC_DIR: "/var/lib/glpi/files"

GLPI_CACHE_DIR: "/var/lib/glpi/files/_cache"

GLPI_CRON_DIR: "/var/lib/glpi/files/_cron"

GLPI_GRAPH_DIR: "/var/lib/glpi/files/_graphs"

GLPI_LOCAL_I18N_DIR: "/var/lib/glpi/files/_locales"

GLPI_LOCK_DIR: "/var/lib/glpi/files/_lock"

GLPI_PICTURE_DIR: "/var/lib/glpi/files/_pictures"

GLPI_PLUGIN_DOC_DIR: "/var/lib/glpi/files/_plugins"

GLPI_RSS_DIR: "/var/lib/glpi/files/_rss"

GLPI_SESSION_DIR: "/var/lib/glpi/files/_sessions"

GLPI_TMP_DIR: "/var/lib/glpi/files/_tmp"

GLPI_UPLOAD_DIR: "/var/lib/glpi/files/_uploads"

GLPI_INVENTORY_DIR: "/var/lib/glpi/files/_inventories"

GLPI_THEMES_DIR: "/var/lib/glpi/files/_themes"

GLPI_PLUGINS_DIRECTORIES: ["/var/lib/glpi/marketplace","/var/www/glpi/plugins"]

GLPI_NETWORK_API_URL: "https://services.glpi-network.com/api"

GLPI_NETWORK_REGISTRATION_API_URL: "https://services.glpi-network.com/api/registration/"

GLPI_MARKETPLACE_PLUGINS_API_URI: "https://services.glpi-network.com/api/marketplace/"

Plugins list
actualtime           Name: ActualTime                     Version: 4.1.3        State: Installed / not activated                Install Method: Marketplace
fields               Name: Additional fields              Version: 1.24.5       State: Installed / not activated                Install Method: Marketplace
advancedforms        Name: advancedforms                  Version: 1.3.0        State: Installed / not activated                Install Method: Marketplace
datainjection        Name: Data injection                 Version: 2.15.11      State: Installed / not activated                Install Method: Marketplace
gantt                Name: gantt                          Version: 1.3.4        State: Installed / not activated                Install Method: Marketplace
tag                  Name: Gerenciamento de Etiquetas     Version: 2.14.7       State: Installed / not activated                Install Method: Marketplace
glpiinventory        Name: GLPI Inventory                 Version: 1.6.10       State: Installed / not activated                Install Method: Marketplace
addressing           Name: IP Addressing                  Version: 3.2.11       State: Installed / not activated                Install Method: Marketplace
mailanalyzer         Name: Mail Analyzer                  Version: 4.0.2        State: Installed / not activated                Install Method: Marketplace
oauthimap            Name: OAuth IMAP                     Version: 1.5.4        State: Installed / not activated                Install Method: Marketplace
samlsso              Name: samlsso                        Version: 1.3.1        State: Installed / not activated                Install Method: Marketplace

Anything else?
This issue exists in an homologation instance after upgrade to release 11.0.9, but doesn't exist in the productive instance release 11.0.8.

[aron-intframe]

Cause: Webhook::addParentItemData() (src/Webhook.php:634-643) assumes every CommonDBChild payload carries itemtype / items_id. TicketValidation (and ChangeValidation) are CommonDBChild with a fixed parent (public static $itemtype = Ticket::class; public static $items_id = 'tickets_id';), and their HL API schema (ITILController.php:859-931) only exposes tickets_id, never itemtype/items_id. So $parent_itemtype is null.

Why it only breaks since 11.0.9: commit 80152b7 ("webhooks use real parent item schema for body content") replaced getParentItemSchema($itemtype) with getAPISchemaBySupportedItemtype($parent_itemtype). That method has a string type on $itemtype, so the same null that was only a warning in 11.0.8 (cf. #23069) is now a TypeError, which Webhook::raise() catches and turns into the "An error occurred raising "Update" webhook" popup. The approval itself is saved (raise() runs after the DB update and is non-blocking); only the webhook is never sent. add/delete events and Change approvals hit the same path.

Minimal repro of those lines with a TicketValidation-shaped API payload (PHP 8.2):

$ php repro.php
Warning: Undefined array key "itemtype" at line 21
Warning: Undefined array key "items_id" at line 22
TypeError: getAPISchemaBySupportedItemtype(): Argument #1 ($itemtype) must be of type string, null given, called in /w/repro.php on line 29

--- with the fix (use the child's static parent definition when the payload has no itemtype/items_id) ---
resolved parent: Ticket #1234

Fix that keeps the polymorphic case working: derive the parent from the child class when it has a fixed parent.

--- a/src/Webhook.php
+++ b/src/Webhook.php
@@ -631,8 +631,15 @@
     private function addParentItemData(array &$data, string $itemtype, int $items_id): void
     {
         if (is_subclass_of($itemtype, CommonDBChild::class)) {
-            $parent_itemtype = $data['item']['itemtype'];
-            $parent_id = $data['item']['items_id'];
+            if (preg_match('/^itemtype/', $itemtype::$itemtype)) {
+                // polymorphic child: parent is stored in `itemtype`/`items_id`
+                $parent_itemtype = $data['item']['itemtype'];
+                $parent_id = $data['item']['items_id'];
+            } else {
+                // fixed parent (TicketValidation, ChangeValidation, ...): only the FK field is in the API payload
+                $parent_itemtype = $itemtype::$itemtype;
+                $parent_id = $data['item'][$itemtype::$items_id];
+            }
         } elseif (is_subclass_of($itemtype, CommonITILTask::class)) {

Applied to the 11.0.9 file it passes php -l; the same code is still on main (Webhook.php:715-727), so it would need to go to 11.0/bugfixes. Until then the only workaround is to patch that block locally; disabling the "Ticket approval" webhook stops the popup but obviously stops the notification too.