WebAPI get user and patient list