This is probably because devise does not expose their internal attributes.
So to get all attributes you can use .attributes (documented here) which returns a hash, on which you can call to_json:
user = User.find(1)
user.attributes.to_json # => contains all fields like reset_password_token etc.