Three Tiered. You just need to adjust yout misunderstanding what this means.
Your Web API is not a service, it is a UI layer. It naturally does all the UI tuff - like also reforming business data to the needs of a presentation.
A UI is a user interface - it is not necessarily graphical. In the case of a WepApi, the user is the other program using it to pull the data. And naturally the WebApi will do a lot of stuff that you need to do in any front end - user and input sanitation, transformations to the exact need of the presetnation etc. It is the front end, the presetnation and the end of the application's trust boudary (never trust input you get via WebApi) - only that another program uses it, not a person.