RewriteEngine On

# API routing
RewriteRule ^users/?$ users.php [QSA,L]
RewriteRule ^users/([0-9]+)/?$ users.php?id=$1 [QSA,L]

# Security - block direct access to config/includes
RewriteRule ^(config|includes)/ - [F,L]