The http request node (and many others) can be configured with a blank url -- then, if the incoming msg contains a url field, it will be used in the http request. A good example of how to do it is in this thread
So I would suggest that your subflow includes a change node upstream of the http request node, which builds the target string and a sets it on the msg.url field. The only thing I'm not sure about is how to get the current subflow's id inside a change node... but if that's not available, just use another env var, maybe?
