try with policy

Author: francisco-videira-nhs

proxies/sandbox/apiproxy/policies/AssignMessage.AddBaseUrlHeader.xml

@@ -0,0 +1,9 @@
+<AssignMessage async="false" continueOnError="false" enabled="true" name="AssignMessage.AddBaseUrlHeader">
+    <Set>
+        <Headers>
+            <Header name="x-ers-sandbox-baseurl">https://{request.header.Host}/{proxy.basepath}</Header>
+        </Headers>
+    </Set>
+    <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
+    <AssignTo createNew="false"/>
+</AssignMessage>

sandbox/src/routes/r4/retrieveAttachment.js

@@ -19,7 +19,7 @@ module.exports = [
 
       const binaryId = request.params.binaryId;
       const objectStore = "/ObjectStore/d497bbe3-f88b-45f1-b3d4-9c563e4c0f5f";
-      const location = request.server.info.protocol + "://" + request.headers['host'] + objectStore;
+      const location = request.headers['x-ers-sandbox-baseurl'] + objectStore;
 
       if ((validationUtil.hasLegacyPrefix(binaryId) || validationUtil.isValidUuid(binaryId)) && request.method === 'get') {
         const response = h.response().code(307);