When you look at the SOAP from the WSDL for all the get* and list* functions in AXL, you see a <returnedTags> node, where you leave the empty names of the filelds you wish returned.  Thus the name, returnedTags.
CUCM 8.6.1
Is there a way to specify all attributes?  I.e. I could build this doc:
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns="http://www.cisco.com/AXL/API/8.5">
   <soapenv:Header/>
   <soapenv:Body>
      <ns:listUser sequence="?">
         <searchCriteria>
            <userid>SomeUserID</userid>
         </searchCriteria>
         <returnedTags uuid="?">
            <firstName/>
            <middleName/>
            <lastName/>
            <userid/>
            <telephoneNumber/>
            <mailid/>
            <department/>
            <manager/>
            <userLocale/>
            <primaryExtension>
                  <pattern/>
                  <routePartitionName/>
            </primaryExtension>
            <associatedPc/>
            <enableCti/>
            <presenceGroupName uuid="?"/>
            <subscribeCallingSearchSpaceName uuid="?"/>
            <enableMobility/>
            <enableMobileVoiceAccess/>
            <maxDeskPickupWaitTime/>
            <remoteDestinationLimit/>
            <status/>
            <enableEmcc/>
         </returnedTags>
         <!--Optional:-->
         <skip>?</skip>
         <!--Optional:-->
         <first>?</first>
      </ns:listUser>
   </soapenv:Body>
</soapenv:Envelope>
 
But surely there is a better shortcut for 'all attributes'?  I say this, since in my testing, I somehow triggered what I think is that shortcut, but I lost the example in all my testing, and did not notice it stop sending all, so I have no clue what I did to get 'all attributes'? 
 

You would think so.  I tried that earlier. 
 
sent in:
    <soapenv:Envelope xmlns:ns="http://www.cisco.com/AXL/API/8.5" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
      <soapenv:Header/>
      <soapenv:Body>
        <ns:listDeviceProfile sequence="?">
          <searchCriteria>
            <name>%</name>
          </searchCriteria>
        </ns:listDeviceProfile>
      </soapenv:Body>
    </soapenv:Envelope>


 
Returns:
    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
      <soapenv:Body>
        <soapenv:Fault>
          <faultcode>soapenv:Server</faultcode>
          <faultstring>Usage: Required returnedTags as empty tag or should contain requested tags</faultstring>
          <detail>
            <axlError>
              <axlcode>5003</axlcode>
              <axlmessage>Usage: Required returnedTags as empty tag or should contain requested tags</axlmessage>
              <request>listDeviceProfile</request>
            </axlError>
          </detail>
        </soapenv:Fault>
      </soapenv:Body>
    </soapenv:Envelope>


So I beg to differ.    Did get the header right I think, Auth and SOAPAction: CUCMB ver=8.5 listDeviceProfile

Looking at the schema, it shows that <returnedTags> is optional for getCss and required for listCss.  Glancing at a few other getXXX and listXXX requests seems to bear out that pattern: listXXX requests require a <returnedTags>, and any fields you want to see must be specified. 
An option to request all available fields for a listXXX request sounds like a good enhancement.  I can see that working either by behaving like the getXXX requests - where if you ommitt <returnedTags> than all tags are provided - or perhaps via an attribute, like <returnedTags all="True">.  The first has some benefits by way of backward compatibility for older apps that are unaware of <returnedTags>.