Is the delete needed? From the ClickOps GUI perspective, when you update a cert for renewal, you import the renewed cert with the same object name and it automatically overwrites the object.
There is an API endpoint for Palos, but it’s probably not as robust as the GUI. I wouldn’t know, I’ve never used it except for monitoring tool configs.