diff --git a/sandbox/src/routes/stu3/services/mockResponseProvider.js b/sandbox/src/routes/stu3/services/mockResponseProvider.js
index e07279f98..dcbb227b7 100644
--- a/sandbox/src/routes/stu3/services/mockResponseProvider.js
+++ b/sandbox/src/routes/stu3/services/mockResponseProvider.js
@@ -166,19 +166,24 @@ module.exports = {
 
   getExampleResponseForRetrieveAttachment: function (request) {
 
-    const attachmentId = request.params.attachmentLogicalID
+    const attachmentId = request.params.attachmentLogicalID;
 
     if (attachmentId) {
       
       if (attachmentId.startsWith('att-')) {
-        return { responsePath: 'stu3/retrieveAttachment/responses/example_attachment.pdf', filename: 'example_attachment.pdf', responseCode: 200 }
+        return { responsePath: 'stu3/retrieveAttachment/responses/example_attachment.pdf', filename: 'example_attachment.pdf', responseCode: 200 };
       }
       
-      if (attachmentId === 'c5d2d200-7613-4a69-9c5f-1bb68e04b8d8') {
-        return { responsePath: 'stu3/retrieveAttachment/responses/example_attachment.pdf', filename: 'example_attachment.pdf', responseCode: 200 }
+      if (this.isvalidUuid(attachmentId)) {
+        return { responsePath: 'stu3/retrieveAttachment/responses/example_attachment.pdf', filename: 'example_attachment.pdf', responseCode: 200 };
       }
     }
 
+    return {};
+  },
+
+  isvalidUuid: function(string) {
+    return /^[0-9A-F]{8}-[0-9A-F]{4}-[4][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i.test(string);
   },
 
   getExampleResponseForRetrieveReferralRequest: function (request) {
diff --git a/tests/sandbox/stu3/test_a006_get_attachment.py b/tests/sandbox/stu3/test_a006_get_attachment.py
index e57c001b6..6ba59ffa1 100644
--- a/tests/sandbox/stu3/test_a006_get_attachment.py
+++ b/tests/sandbox/stu3/test_a006_get_attachment.py
@@ -22,14 +22,15 @@ class TestGetAttachment(SandboxTest):
         required_business_functions=allowed_business_function_data
     )
 
-    testdata = [
+    valid_test_data = [
         (
             "att-70000-70001",
             "stu3/retrieveAttachment/responses/example_attachment.pdf",
             "example_attachment.pdf",
         ),
         (
-            "c5d2d200-7613-4a69-9c5f-1bb68e04b8d8",
+            # Any arbitrary v4 UUID should work here
+            "f1b1b2b1-30db-48f9-8906-8b703adca5fb",
             "stu3/retrieveAttachment/responses/example_attachment.pdf",
             "example_attachment.pdf",
         ),
@@ -63,7 +64,7 @@ def call_endpoint(
         )
 
     @pytest.mark.parametrize("actor", authorised_actor_data)
-    @pytest.mark.parametrize("id,response, filename", testdata)
+    @pytest.mark.parametrize("id,response, filename", valid_test_data)
     def test_success(
         self,
         call_endpoint_url_with_pathParams: Callable[
@@ -90,3 +91,16 @@ def test_success(
                 "content-length": str(len(expected_response)),
             },
         )
+
+    @pytest.mark.parametrize("actor", authorised_actor_data)
+    def test_failure_not_a_uuid(
+        self,
+        call_endpoint_url_with_pathParams: Callable[
+            [Actor, Dict[str, str], Dict[str, str]], Response
+        ],
+        actor: Actor,
+    ):
+        response = call_endpoint_url_with_pathParams(
+            actor, {"attachmentLogicalID": "f1bb2b1-30db-48f9-8906-8b703adca5fb"}
+        )
+        asserts.assert_status_code(404, response.status_code)