Unable to disable WAF rule via API

I am trying to make changes to a WAF rule via the API. This is all in relation to a larger effort to automate Let's Encrypt renewals. I have ready many posts on here and found a few smaller github repos with examples but none of them get the entire workflow.

I am able to upload a new certificate, or update an existing certificate via the API but I cannot update an existing certificate if it is in use by a WAF rule (error 542).

So my aim was to create a new certificate and then modify the WAF rule to use that, however I am unable to make any changes via the API. I have tried the oft-recommended example of exporting current "good" config and only making minor edits but I consistently get an unhelpful error. This error was purely changing from Enable to Disable in the Status key.

gigeo@angel:~$ cat test_change_cert.xml | curl -k -F "reqxml=<-"   "https://172.16.16.16:4444/webconsole/APIController?"
<?xml version="1.0" encoding="UTF-8"?>
<Response APIVersion="1702.1" IPS_CAT_VER="1">
  <Login>
    <status>Authentication Successful</status>
  </Login>
  <FirewallRule transactionid="">
    <Status code="500">Operation could not be performed on Entity.</Status>
  </FirewallRule>
</Response>

Here is the test XML file.

<?xml version="1.0" encoding="UTF-8"?>
<Request APIVersion="1702.1">

  <!-- Authenticate -->
  <Login>
    <Username>xxx</Username>
    <Password passwordform="plain">xxx</Password>
  </Login>

  <!-- Upload Letsencrypt Certificate Authority -->
  <Set operation="update">
    <FirewallRule>
      <Name>HTTPS_Webservers</Name>
      <Description/>
      <IPFamily>IPv4</IPFamily>
      <Status>Enable</Status>
      <Position>Top</Position>
      <PolicyType>HTTPBased</PolicyType>
      <HTTPBasedPolicy>
        <HostedAddress>#PortB</HostedAddress>
        <HTTPS>Enable</HTTPS>
        <ListenPort>443</ListenPort>
        <Domains>
          <Domain>xxx.xxx</Domain>
          <Domain>xxx.xxx</Domain>
          <Domain>www.xxx.com</Domain>
        </Domains>
        <AccessPaths>
          <AccessPath>
            <allowed_networks>Any IPv4</allowed_networks>
            <auth_profile/>
            <backend>Angel (HTTP)</backend>
            <be_path/>
            <hot_standby>0</hot_standby>
            <path>/</path>
            <stickysession_status>0</stickysession_status>
            <websocket_passthrough>0</websocket_passthrough>
          </AccessPath>
        </AccessPaths>
        <Exceptions>
        </Exceptions>
        <ProtocolSecurity/>
        <CompressionSupport>Disable</CompressionSupport>
        <RewriteHTML>0</RewriteHTML>
        <PassHostHeader>Enable</PassHostHeader>
        <RewriteCookies>Enable</RewriteCookies>
        <IntrusionPrevention>None</IntrusionPrevention>
        <TrafficShapingPolicy>None</TrafficShapingPolicy>
      </HTTPBasedPolicy>
    </FirewallRule>
  </Set>
</Request>