1- Can we pass the JWT it self as bearer token or we have to call oauth2 token endpoint to get access token
No, the self-signed JWT is not a bearer token. Maybe this is a helpful way to think about it: the JWT is an alternative to "client credentials" in an OAuth grant. You send the JWT to the oauth token dispensing endpoint (this is described in RFC 7523), instead of "normal" (RFC 6749) client credentials, which is just a Basic Auth header encoding the consumer ID and Secret. What you get back from Google's oauth endpoint, is an opaque access token. You need to use the opaque access token as a bearer token when sending in requests to the API endpoint apigee.googleapis.com .
For more information on using self-signed JWT to get access tokens, please see this older discussion.
2 - What should be the scope while generating JWT . we need admin role for operation activity .
The scope should be https://www.googleapis.com/auth/cloud-platform . Then rely on the ROLES attached to the service account do restrict access. A role might be Apigee Organization Admin (roles/apigee.admin) . or some more restricted role, like Apigee API Admin (roles/apigee.apiAdminV2) or Apigee API Reader (roles/apigee.apiReaderV2). Or some custom role that you define. Find the list of "built in" Apigee roles and their associated permissions here: https://cloud.google.com/iam/docs/understanding-roles#apigee-roles
BTW, to find that "cloud-platform" scope value, I just looked in the discovery document for the Apigee API. There really is just one scope for Apigee. For some APIs, there are different scopes supported, for restricting the token to be usable for narrower operations than the roles on the account allow. But Apigee doesn't use scopes for that purpose.
Any reference API (Library) to generate JWT and get access token?
The documentation for the Apigee APIs says
To call this service, we recommend that you use the Google-provided client libraries.
If that's not suitable, then, you can google around for other options. (Example1 for bash) What language are you using? Here's an example for Java.
LinkedIn
Twitter
