As @sergio said, the ParamsWrapper maps the available attribute based on the attribute_names method. So you can change the default behavior of ParamsWrapper, using the following code:

class UsersController < ApplicationController
  before_action :set_user, only: %i[ show update destroy ]

  wrap_parameters :user, include: [:email_address, :password, :password_confirmation]

  # POST /users
  def create
    @user = User.new(user_params)

    if @user.save
      render json: @user, status: :created, location: @user
    else
      render json: @user.errors, status: :unprocessable_entity
    end
  end

  #...

  private
    #...

    # Only allow a list of trusted parameters through.
    def user_params
      params.expect(user: [ :email_address, :password, :password_confirmation ])
    end
end