Windows has a pretty good story for the management of certificates and private keys with the certificate store and key store. Many (most? all?) cloud services have a pretty good story for the transportation of certificates so they can be used for SSL/TLS. I don't know of any particularly good management for HMAC keys (the closest thing being a general settings transportation system).
Certificates have enough metadata that a system/service admin/(dev)op can see which one is being used to help diagnose why something isn't working, and it can be done on the non-sensitive portion of the data (the public key). An HMAC key, on the other hand, either has to be revealed in its entirety and compared byte by byte (or hex nybble by hex nybble, etc) or have some form of hashing applied to it to obfuscate the value but still allow the value to be compared across machines.
These reasons, mainly, are about "ease of management" on the part of the client. Being able to be used correctly is an important aspect for security, but it's a less obvious one. You still need to have an appropriate registration model for the certificates, either by using your own CA to control subject naming (which requires revocation as a cancellation mechanism) or by storing the certificate (or public key) the same way you would have stored their HMAC key (which can avoid the need for revocation)... you want to only let the appropriate certificates authenticate a particular user.
Windows private key management allows for applications to use the key without being able to export it, meaning that system operators that only have access to running instances can't then act as the system at home. An HMAC key has the problem that "use it" and "exfiltrate it" are the same permission. This is an operational security problem. An overly loggy client application can easily get itself in trouble with logging the HMAC key; but for a cert it would require a) the private key permissions to allow exporting the key material and b) someone going out of their way to move the key object into a loggable form.
Oh, and client auth certificates can also have their private keys on an HSM, making exfiltration even harder, and depending on what your API allows some of your callers may feel that they need HSM security.
So: mostly ease of management, and a couple of op-sec reasons.
