My bad, I was automatically assuming that this could be achieved in the sandbox but after speaking with the team - I realised this was not the case. 
You can only access the vault variables in the URL, Params, Headers, Body and the Auth helper fields.
