RewriteEngine On
RewriteBase /server/api/calls/
# Exclude admin routes
RewriteCond %{REQUEST_URI} !^/api/admin/
# Only process calls routes
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ routes.php [QSA,L]

# Prevent direct access to PHP files
<FilesMatch "\.php$">
  Order Allow,Deny
  Deny from all
  <Files "routes.php">
    Order Allow,Deny
    Allow from all
  </Files>
</FilesMatch>