From the Third-party API side, I get that the response is in binary(?). In that case, Request API may not be the best fit as it only deals with responses of type - String, JSON, or XML.
In the case of serverless, I see that you have made use of SMI along with Axios/request npm. If you were to invoke the call from the frontend, it has to finish within 5s. If not, It will end up in a timeout. And again. SMIs can return only JSON - making it near-impossible to build the use-case solely within the platform.
At this point, one of the feasible approaches would be to have a middleware server that downloads the file from the third-party API, generates a link, and shares it to the custom app. The generated link has to be signed & short-lived thus making it only accessible to an intended requestor.
An alternate approach is to see if the third-party has any sort of Document Management System (DMS) integration in place. Certain DMS have APIs that facilitate file sharing by default.
Also, please feel free to share some details about the third-party API that you are trying to use. It will definitely help us understand your situation