RewriteEngine On

# API routes
RewriteRule ^api/users/?$ users/get.php [QSA,L]
RewriteRule ^api/users/([0-9]+)/?$ users/get.php?id=$1 [QSA,L]
RewriteRule ^api/users/update/?$ users/update.php [QSA,L]

# Deny access to includes
RewriteRule ^includes/ - [F,L]